MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6153d2cc6424424159b7d2093e6e388bd18db1effe60ce36cebf61f0382bc77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ISRStealer


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6153d2cc6424424159b7d2093e6e388bd18db1effe60ce36cebf61f0382bc77
SHA3-384 hash: 805d97d0c1dc8ae189b1bc9499b184196ac560975371cfd1435514425b02f4003c57dde1208fc6a5a9a44fa8b3741960
SHA1 hash: 6d48c0b4daf439f85de17f9215a87712f27d8ad2
MD5 hash: 4fa12fc162acc3eadbdbbf970075f5f6
humanhash: early-sodium-music-ceiling
File name:HBL SCAN03-XML.eml.zip
Download: download sample
Signature ISRStealer
Create hunting rule
File size:610'626 bytes
First seen:2020-11-06 17:32:58 UTC
Last seen:2020-11-09 06:33:07 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:OeUawzgVNUtzMLnhkFHgky4r0PRjsUSLLT9UoYj1yeRFq7chMvJGxabHiQmeHbY:2MLUtzMLhkFH5ropjsUSXTqowgWFRqGj
TLSH 39D42346627782BCD3954273D26A39EC0D429D02FE5BE42B377E111C5FA07DE68CD90A
Reporter abuse_ch
Tags:ISRStealer zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: jktd3khmail02v.cloudkilat.me
Sending IP: 103.43.47.239
From: Muhammad Imran Younas <contact@lesalignon.com>
Subject: HBL# KHI0021448 SHIPMENT
Attachment: HBL SCAN03-XML.eml.zip (contains "HBL SCAN03-XML.eml.exe")

Intelligence

File Origin
# of uploads :
21
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6153d2cc6424424159b7d2093e6e388bd18db1effe60ce36cebf61f0382bc77/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ykt2lggijccifm3puqjhzxdrc6rrwy677tazy3m5p3b6a4cxr3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ISRStealer

zip d6153d2cc6424424159b7d2093e6e388bd18db1effe60ce36cebf61f0382bc77

(this sample)

ISRStealer

Executable exe e2842ccca2aa0d0ad397af687936f09c819f4329c523af263ec058003bbc8497

  
Dropping
MD5 cbc2d6f19dba0ecb1b317a8b22907296
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2842ccca2aa0d0ad397af687936f09c819f4329c523af263ec058003bbc8497

Comments