MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
SHA3-384 hash: e3c89a00d2d00659c00af0995598521d0769e4e32ae7f2cfeeeb710c1a7f51c3dfbbaeaac67a9fd79fd72b796e54b34c
SHA1 hash: b16b0950051f5a6314d5fc843d1377e8edce26de
MD5 hash: fee5c4ce1be82752265349da9b2e03d4
humanhash: four-fruit-seven-fifteen
File name:0Tramxygit_pqygaj.523677ZJSPJ.iso
Download: download sample
File size:5'554'176 bytes
First seen:2026-08-07 07:15:56 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 49152:rf06GFmqF5yMCYk8pMsv1ekppfcYvQySutQ/cELEOpIVzvpix6yL3l/txM0bSSJF:P
TLSH T1914623336F65196FC970533AB02F29327F7E541B424CDAE6AD5CA1013F8B1C5863B4AA
TrID 87.8% (.NULL) null bytes (2048000/1)
10.9% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.5% (.WAR) Warcraft game data archive (12007/4/6)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.2% (.CPT) Mac Compact Pro archive (5000/1/2)
Magika iso
Reporter abuse_ch
Tags:geo iso MEX

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
CH CH
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:necg1.xml
File size:21'792 bytes
SHA256 hash: 1d1636ff8d193f883b181efac6d7d5404d8dc1a51027f318f82e1437699d68db
MD5 hash: 9c6571a544b026eda6bfd3d76d91949b
MIME type:application/x-dosexec
File name:abftq2.xml
File size:13'456 bytes
SHA256 hash: 028c2b444ec7abddb13448c13317d1e26d7a644c65e2371d9115e1b9eff96daa
MD5 hash: 3db8784dfca11580984cf02855fb7841
MIME type:application/x-dosexec
File name:isdok2.pdf
File size:25'216 bytes
SHA256 hash: dcd115f95c3bd1ae2ee4479c9dcaf96391f900845d21844e546bc2e3b1c469f5
MD5 hash: 172e9ca72d015f8da1fe7ec3acb0b3e5
MIME type:application/pdf
File name:pahabz1.pdf
File size:38'130 bytes
SHA256 hash: cd815bfbc4c8d41909268c43d76b4a47cf041004faac32fc2d8de24edceb0685
MD5 hash: 73697ef5f26f094fa1e86c7f7b61f933
MIME type:application/pdf
File name:_Serie-71963-CMBKJScktoqe.FFIOMProcpxlhk.vbs
File size:5'059'926 bytes
SHA256 hash: c011a552081dead8ee59da97d6c7004c179a58fcfe2fdfa11967b6502bc295b9
MD5 hash: 24a867144db4f4f1718624294c9d3021
MIME type:text/plain
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5c1294b4-9fc6-4ee3-9226-2b7e5cf13184/
Detection(s):
SecuriteInfo.com.Script.SNH-gen.19324994.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-07 07:16:40 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
4 of 36 (11.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tt7zsnaiewltra575o3zezfemndq3bgy475rhw4f7knwqchsxgga._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
adware defense_evasion discovery execution link pdf persistence ransomware spyware
Link:
https://tria.ge/reports/260807-le2e4sbk4y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Executes a VBScript file via the Windows Script Host.
Checks computer location settings
Executes dropped EXE
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

iso 9cff99340825973883bfebb79264a463470d84d8e7fb13db85fa9b6808f2b98c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898359/
  
Delivery method
Distributed via web download

Comments