🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a
SHA3-384 hash: c707aadcadc401374124f2026997bf296d238cee70c5659f2e3fb7f94f9cc3491a2052a5170b57278c925f0ac20dc141
SHA1 hash: eb8e98c66ea3f08de054b3dcdae38a6a754087db
MD5 hash: a55a93669b6fda2d85ea2fcc0a165ce2
humanhash: grey-autumn-iowa-london
File name:SSA-Statement-09112026-185242.iso
Download: download sample
File size:1'673'216 bytes
First seen:2026-09-19 17:06:37 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:MwswAXLDXbIYO0Z8pnDV0/tMiPCvErjjHIG84iCV642dzDeDqrTNwjZx:AXLDrDZ8pDV0TCvELHi22hDsqfN
TLSH T1FD7539CB8C684CA5F4D3C5B35C30CA61F17D778DF41AA94A305C626C2B2B752AF1E2A5
TrID 88.5% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika iso
Reporter smica83
Tags:iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:eSSA-Statement-6858497872-pdf.exe
File size:130'320 bytes
SHA256 hash: 7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3
MD5 hash: 8ad76e0b347bb690697535ce95b1c656
MIME type:application/x-dosexec
File name:goopdate.dll
File size:1'128'432 bytes
SHA256 hash: 54d95a19a2ce05b1d8c66c21f2863658960f609fa809cdce43b6a0192a8eda6e
MD5 hash: 94dd805761d28c7dccf847deada975dd
MIME type:application/x-dosexec
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7c57c325-d369-4629-94e4-7fc509124679/
Detection(s):
Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.29527.BadIso.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acc9e9aa98509a05d381d82
Tags:
cobaltstrike virus
Verdict:
Unknown
Threat level:
n/a  -.1.0/10
Confidence:
100%
Tags:
anti-debug evasive expired-cert fingerprint installer-heuristic masquerade microsoft_visual_cc reconnaissance signed
Link:
https://www.filescan.io/uploads/6aaec146c1a6fdbc54d05b8f/reports/64b3336c-0db1-4a6f-a5c0-8a99336784dd/overview
Verdict:
Suspicious
Labled as:
ABTrojan.STKC
Link:
https://www.hybrid-analysis.com/sample/3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a
Verdict:
Malicious
File Type:
iso
First seen:
2026-09-11T11:35:00Z UTC
Last seen:
2026-09-11T11:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a/results?tab=lookup
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Executable ISO9660 Image PDB Path PDF /OpenAction PDF Contains AutoAction PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/a55a93669b6fda2d85ea2fcc0a165ce2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-09-12 00:00:29 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hybhhuftvwuh4el5uhccdkwajtjlrlfcbkb3umkqfozfenr7urfa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware defense_evasion discovery revoked_codesign spyware trojan
Link:
https://tria.ge/reports/260919-wm54daej3z/
Behaviour
Modifies system certificate store
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3e0273d0b3ada87e117da1c421aac04cd2b8aca20a83ba31502bb252363fa44a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments