🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3
SHA3-384 hash: bdd38389beefcc2ac681eb5facd71700df3d6f9022769a4ef3709e49001e13354ae0ca00e7768cb9e7fe5da379dc37d1
SHA1 hash: a520014709558f2e5ae22def65292fe60ca175b2
MD5 hash: c7ef5870bd14da965aba841ff34d7b3c
humanhash: sink-earth-jig-mango
File name:4.iso
Download: download sample
File size:15'609'856 bytes
First seen:2026-10-06 07:59:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 196608:1mLxFpcBhORoZbHiXUxO/RJk3IWhlbntjE:1mL/Ewm1HiXUxO/RJk3IWhlbntj
TLSH T106F6D7429AA7CEC2E6F75B78E6E8A36362367E177A3140493BD81F271F332508593351
TrID 88.3% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.BCK) BackupExpress Pro (6015/5/3)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
Magika iso
Reporter smica83
Tags:iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
HU HU
File Archive Information

This file archive contains 29 file(s), sorted by their relevance:

File name:SDKAddonLangVer.dll
File size:10'760 bytes
SHA256 hash: e5fc020d5e1cead98b9da1494803f04bc6a13d039855855f2ce894b2dac25939
MD5 hash: d9a25693b1a257bd205fbc48c90008f1
MIME type:application/x-dosexec
File name:NonSDKAddonLangVer.dll
File size:10'760 bytes
SHA256 hash: 5e56a5fb796ccc733306a4aac6bef90234424c440b85125169a5094f91add9d9
MD5 hash: 75ae87f775de4afc82f86a7b9a68de6d
MIME type:application/x-dosexec
File name:01-Open to view.EXE
File size:461'832 bytes
SHA256 hash: 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
MD5 hash: cb39911e14440fea03b4b1d1d0be174d
MIME type:application/x-dosexec
File name:icudtl.dat
File size:12'461'408 bytes
SHA256 hash: 45f7134340f3479f46d2e36f4fb663a86cf0a81484d93d851806fcaf2fc8257c
MD5 hash: d086c1bcbee19cb2f0787392fc32b410
MIME type:application/octet-stream
File name:mfc140u.dll
File size:1'845'760 bytes
SHA256 hash: 32def4eb81ddae07165cac00a332a34870f8d1511ac5e865ddb9926bc8a47d9d
MD5 hash: a86f557d5935c54b5990e6af1b123ef2
MIME type:application/x-dosexec
File name:Microsoft.TypeMaps.xsl
File size:4'635 bytes
SHA256 hash: 45fbe33a36ee678c864add864187a7d13b38fb9074bfe9f06b6e490ed74a9cde
MD5 hash: 38645317f22f40d7281d3004858f97ac
MIME type:text/xml
File name:Microsoft.VisualStudio.SmartDevice.UnitTesting.xsl
File size:19'504 bytes
SHA256 hash: 8d0a844af325fa80e60552d881ace00b542bc6768043817ff8063b7db3954795
MD5 hash: 66108f77044411562c41f97b84fba494
MIME type:text/xml
File name:Microsoft.VisualStudio.Debugging.xsl
File size:30'379 bytes
SHA256 hash: d14135ff3082e67c7e78bcfdb593d2f9407cbb3cbb69f53c944e5d1102d567af
MD5 hash: 7d18689f41f8b47db5fbe038b805303f
MIME type:text/xml
File name:Microsoft.NetCF.2.0.xsl
File size:80'811 bytes
SHA256 hash: 3b51c9e79113a1daf299c77888cd02f105db2cbdce52f341a6d5ebc3ed12e36f
MD5 hash: 28ec8016fff25b4a3f9ed68c7b9ce339
MIME type:text/xml
File name:Microsoft.WindowsMobile.SmartPhone.1.0.Inplace.xsl
File size:34'217 bytes
SHA256 hash: 8b2cfd452922a148469470b4b4a4cc8f943c41ff0f4821b25e1f4ffaaef90e70
MD5 hash: 3597846fe1aec024d17a62e37f18e96d
MIME type:text/xml
File name:Microsoft.RemoteTools.Packages.xsl
File size:34'817 bytes
SHA256 hash: 413f6f554f27b234baf4e594dd741145c142c23054172c7810b3cf33d2e31191
MD5 hash: e32feba693d99b6e8941bab9598838e5
MIME type:text/xml
File name:Microsoft.WindowsMobile.SmartPhone.1.0.Inplace.xml
File size:5'131 bytes
SHA256 hash: ec4f05faca9a159962dc7cbf81a3d520ad4bdc253d4db41ac5289f05726d2f11
MD5 hash: 2615aba5fdff82c935c0c397e1e3bca0
MIME type:text/xml
File name:208CEAED-29A9-4C67-B45C-4C8CCD8A44D7.xsl
File size:48'710 bytes
SHA256 hash: 4ab542e7639122c03126e002d04e6dfc0b5afda75682488ba0fa945628c6c933
MD5 hash: 2e5d19e6cc8670355485d4b5cba13c38
MIME type:text/xml
File name:Microsoft.SQLCE.3.5.xsl
File size:36'784 bytes
SHA256 hash: c5f742baaf98fa0f36935d81fc8c6288affae72285a0f67e916860721540f81d
MD5 hash: 5e9241c65a2d6486051d55ebd538a8a5
MIME type:text/xml
File name:Microsoft.SQLCE.3.5.xml
File size:6'510 bytes
SHA256 hash: cfd3173a0c8b7b11c5f2b3495a704baca08f89bab251edbf18a5861289e7127d
MD5 hash: 291be40bae8dc87a8d59c6b9c61837a3
MIME type:text/xml
File name:Microsoft.WindowsCE.xml
File size:3'113 bytes
SHA256 hash: b0967b51cf3db783eecc911f9e94b5db824439e94ac5350bb2c85e2c728f3c85
MD5 hash: fcb9bf5a0a2115e3f00823de1108d8a5
MIME type:text/xml
File name:Versionedrolledsdktemplate.xsl
File size:87'574 bytes
SHA256 hash: 1c9f1b946b769665c276e3fdcef16c831ec13358b3fe39d9599a56b1a416ed17
MD5 hash: c90c071fe67e3b59037f13f415a9aaed
MIME type:text/xml
File name:conman_ds_validator_versioned.xsd
File size:18'690 bytes
SHA256 hash: 12d5ca12fa1557a92f07fb31159f22af3609d7b7485e7551ab3869f4bc588f77
MD5 hash: 9d04146d8cb083e1745b6226ca349cc1
MIME type:text/xml
File name:Versionedemulatorimagetemplate.xsl
File size:23'453 bytes
SHA256 hash: b62c2b47b10ed1094c526f0cd4c250d4711714363e90ad1187406d2ebf69c892
MD5 hash: 78951d945e165d85225287f8c57dd323
MIME type:text/xml
File name:Microsoft.WindowsCE.xsl
File size:11'585 bytes
SHA256 hash: 5eb6557f30dce2911da8ecf8da7283e13fca6adf68cf8dcdf366c3aa0de4189d
MD5 hash: 134d7ca98afee986ca89281b25bb667e
MIME type:text/xml
File name:Microsoft.WindowsMobile.PocketPC.2.0.Inplace.xsl
File size:60'181 bytes
SHA256 hash: 524eef9e3b3fd977fabc13e9fb9b7fd42f732cfe90c30d46046b30c9da8c211b
MD5 hash: 68c104c736de145b3328da37f27b21e2
MIME type:text/xml
File name:Microsoft.ServiceCategories.xml
File size:630 bytes
SHA256 hash: c248cd7f38628c0f3cc0a11e7e0f1c51b93ccb2d7cf468f75873784f6c6782af
MD5 hash: 824637398c1ecfa95d7734c752e16d2b
MIME type:text/xml
File name:Microsoft.VisualStudio.ServiceCategories.xsl
File size:1'221 bytes
SHA256 hash: d170f6afdd70be5716388a956ff2bd6dfdd044b74828683dae022384d05e881a
MD5 hash: f76754f237d18495496132bc8e1ec90b
MIME type:text/xml
File name:Microsoft.ServiceCategories.xsl
File size:4'245 bytes
SHA256 hash: 295631917f5f557bcca325d13567a7d82f8cb5adb6cc2164f00fa4c5c47251e4
MD5 hash: 616108b04a1faef8464e2d7097ce85d9
MIME type:text/xml
File name:Microsoft.NetCF.3.5.xsl
File size:79'556 bytes
SHA256 hash: 9fcbaf577820ffc6544e9f0e8606e5cd16cf39ece73e55cebbf1efdc12e5bd3d
MD5 hash: 5e8d12665df073f63e1ea3b10c0d4dbb
MIME type:text/xml
File name:FA96D76E-30C9-4DDD-947B-00B870AA6281.xsl
File size:71'878 bytes
SHA256 hash: 57e301a5a298906b7b06c565c496e3014a8a323ddfec4125f1e9951dc0ee8868
MD5 hash: bd913fa997885cfa609cde4cf9da3475
MIME type:text/xml
File name:CC
File size:3'399 bytes
SHA256 hash: 7e3043c29b48a50a227331521aebd2ece6f450e3ddc7d0799a92a584f02a9dbc
MD5 hash: df113895629b9d5647d77d349091dc5b
MIME type:image/png
File name:Microsoft.WindowsMobile.PocketPC.2.0.Inplace.xml
File size:8'794 bytes
SHA256 hash: 37159eda201f68b5fa1ef6843b4b61cb4472b0560be5a3b871f0e934bf759879
MD5 hash: b54d29b3488bc6d8c46121b363e58a80
MIME type:text/xml
File name:Microsoft.VisualStudio.ServiceCategories.xml
File size:332 bytes
SHA256 hash: ec8b1ccccff09bd21bffe13f85a42a145f7929572a4bcca0b6e0af97e18af16a
MD5 hash: 4cc5c5f74963ca76d526b644e87b82e6
MIME type:text/xml
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/399a108f-5f2e-4414-ab43-da35f258603a/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acfc65cf4e17c78f71538cf
Tags:
n/a
Gathering data
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3
Verdict:
Malicious
File Type:
iso
First seen:
2026-10-06T05:38:00Z UTC
Last seen:
2026-10-06T05:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/c7ef5870bd14da965aba841ff34d7b3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 04:40:08 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zl2ggrpxh6dzaav4uycjbdfqq5podhr452mtknl2u7ed2ym36orq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor defense_evasion discovery execution persistence rat spyware trojan
Link:
https://tria.ge/reports/261006-kmnzbaea68/
Behaviour
cURL User-Agent
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: LoadsDriver
Suspicious behavior: EnumeratesProcesses
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Gathers system information
Checks SCSI registry key(s)
Executes a command shell one-liner
Enumerates physical storage devices
Modifies trusted root certificate store through registry
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Enumerates video capture drivers
Drops file in Windows directory
Drops file in Program Files directory
Checks installed software on the system
Executes a VBScript file via the Windows Script Host.
Drops file in System32 directory
Checks computer location settings
Power Settings
Enumerates connected drives
Badlisted process makes network request
Adds Run key to start application
DCAgent remote management tool
Sets service image path in registry
Drops file in Drivers directory
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/caf46345f73f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/caf46345f73f879002bca604908cb0875ee19e3cee9935357aa7c83d619bf3a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:attack_India
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments