🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a229408ff1689bab03645c3f723fdd8dcc8d8dfe64f6f57eb1e8f7aa4f13561e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mimikatz


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a229408ff1689bab03645c3f723fdd8dcc8d8dfe64f6f57eb1e8f7aa4f13561e
SHA3-384 hash: 5be1d76586842f00d5d5f481e2cac00aa07bddf139a9ca9033481cbd83c44d14e1918902355b8ae77010d74ba369d51b
SHA1 hash: 2e886e6b47128edac7b601f4a220f01db7c57ec8
MD5 hash: b054f3cb2af9983c5cd3fa34ca2c5c04
humanhash: victor-bluebird-comet-bacon
File name:mystuff_docs.iso
Download: download sample
Signature Mimikatz
Create hunting rule
File size:1'441'792 bytes
First seen:2026-10-12 13:23:13 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:oJSwM+560MrE03u1mHWV/I3z+bQEKZm+jWodEEV7XeempcGGoZVe:4NM+560p1F/IiQEKZm+jWodEENX2
TLSH T1BA654B13F75D1DE4E095E2B891A38712D7F0BC494322A3C752EBA6592F673C1BA3B250
TrID 47.7% (.ISO/UDF) UDF disc image (2114500/1/6)
46.2% (.NULL) null bytes (2048000/1)
5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.1% (.ATN) Photoshop Action (5007/6/1)
0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Magika iso
Reporter smica83
Tags:iso mimikatz

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
HU HU
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:VCRUNTI2.DLL
File size:47'264 bytes
SHA256 hash: e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash: 03b43160d21c08de07a79d0a1c5ee81d
MIME type:application/x-dosexec
Signature Mimikatz
File name:VCRUNTIM.DLL
File size:123'472 bytes
SHA256 hash: 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash: 0d35c5e99871b4f02c490b9fd9dace34
MIME type:application/x-dosexec
Signature Mimikatz
File name:PYTHON31.DLL
File size:20'480 bytes
SHA256 hash: fc8b354fe4dc118f14a52b23e76b918b405b8d7060feae3e3990c84b0c9cdaae
MD5 hash: a6ef65fd8caa06b549c4c9f4c4351608
MIME type:application/x-dosexec
Signature Mimikatz
File name:MSVCP140.DLL
File size:553'552 bytes
SHA256 hash: def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash: 4e3fa9bd90ef020c14359639dc19312b
MIME type:application/x-dosexec
Signature Mimikatz
File name:GISELA_P.EXE
File size:104'280 bytes
SHA256 hash: 49f305f2eebfb144f3a3d040f5e374ccb59c7f00c9ff8ffecfd41616e1e6bfa9
MD5 hash: a4a426a5f4f1b6abe873bf9868188a91
MIME type:application/x-dosexec
Signature Mimikatz
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6afded00-55fa-4782-9277-1fc88126a335/
Gathering data
Verdict:
Suspicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/a229408ff1689bab03645c3f723fdd8dcc8d8dfe64f6f57eb1e8f7aa4f13561e
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/b054f3cb2af9983c5cd3fa34ca2c5c04
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a229408ff1689bab03645c3f723fdd8dcc8d8dfe64f6f57eb1e8f7aa4f13561e/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uiuubd7rncn2wa3elq7xep65rxgi3dp6mt3pk7vr5d32utytkypa._file
Result
Malware family:
mimikatz
Create hunting rule
Score:
  10/10
Tags:
family:mimikatz defense_evasion discovery execution
Link:
https://tria.ge/reports/261012-tlwgfax1ax/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Drops file in Windows directory
Executes dropped EXE
Hide Artifacts: Ignore Process Interrupts
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Downloads MZ/PE file
Command and Scripting Interpreter: PowerShell
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments