MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 8 File information Comments

SHA256 hash:	5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df
SHA3-384 hash:	b230c9c7f06df058149cbc4b146f490e562b735de2d1b7936c438fa0e851a54549296ee9101afdc83bbd21987832d802
SHA1 hash:	9a54fd35062d83e5105bc56bab98bfc743146951
MD5 hash:	b194b81c477a6d9a1b448ee2a5bffa82
humanhash:	johnny-kentucky-jersey-ink
File name:	Reader_en_install.iso
Download:	download sample
File size:	407'552 bytes
First seen:	2026-10-22 18:51:58 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	6144:PfOICnReKRU6dpNUuyFfX/iz5VgZuPFB:P2IMPUXFCtSZcB
TLSH	T12E8439317545CF32D56F017098A49AF99A2FAC218F615BC7B38C7E693B306C2AE31617
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	smica83
Tags:	iso

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:	Reader_en_install.exe
File size:	236'504 bytes
SHA256 hash:	da6b084585498df1d0d89da119bf85c1b8b0182c0469e2632f772bfc8c6fbcf3
MD5 hash:	054a5c41b4f6723fc4bcd098c9cebf9c
MIME type:	application/x-dosexec

File name:	file.txt
File size:	2'898 bytes
SHA256 hash:	22f846d49d9e8d8ab83396c6ebf72a913e2dea992aeca207088408526d835604
MD5 hash:	942a3756080f24dd37807789844240d0
MIME type:	text/x-msdos-batch

File name:	msi.dll
File size:	103'936 bytes
SHA256 hash:	3caa873203e3e0d4dbc4cc031ea31da26b72aee4fe9155b800831c170e80da7e
MD5 hash:	9ac11c5a08b4c8abfd06e2a05d94252c
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Malware configuration found for:

Details

Link:

https://research.acce.ciphertechsolutions.com/results/da5c1a7d-3aac-4cca-9f1d-10021cc42efc/

Detection(s):

TwinWave.EvilISO.PkillWLLIAMThatPower.20221115.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ada5b625a22ac805bd9b1b1

Tags:

shellcode dropper

Verdict:

Unknown

Threat level:

n/a -.1.0/10

Confidence:

100%

Tags:

anti-debug base64 evasive fingerprint microsoft_visual_cc reconnaissance signed

Link:

https://www.filescan.io/uploads/6ada5b60ca63740925c6a824/reports/050fdcf9-a66c-4e82-baa6-700bd54dab00/overview

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df

Verdict:

Malicious

File Type:

iso

First seen:

2026-10-21T12:21:00Z UTC

Last seen:

2026-10-24T05:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df/results?tab=lookup

Verdict:

Malware

YARA:

3 match(es)

Tags:

DeObfuscated Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout PowerShell T1027 T1059.001 T1105

Link:

https://app.malva.re/file/b194b81c477a6d9a1b448ee2a5bffa82

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df/

Threat name:

Win32.Trojan.Runner

Status:

Suspicious

First seen:

2026-10-20 21:26:46 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

7 of 38 (18.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l5f7pcgfhosvxhwrhla5ohtdn3lng6gh2bh7dpm5f3csafopg3pq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Author:	sumeshi
Description:	Hunts for files containing Japanese kana text or common Japanese lure terminology

Rule name:	SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (script_js, etat binaire)

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research

Rule name:	SUSP_VBS_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contain VBS functions
Reference:	Internal Research

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample