MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98
SHA3-384 hash:	717d140b5a53a58c9ba8cfd3012eed8d99266241fcd7294a352f874e686e0d06aa87cd1c6de60316d904c4686f2dd4a0
SHA1 hash:	363a1bfbcbc8e8c8e33ae12b09a97741fb0fccb3
MD5 hash:	d9a8d3d3b190baa6f07624e3263f5bb5
humanhash:	dakota-king-florida-leopard
File name:	PO_11178 PR-39316.iso
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	67'584 bytes
First seen:	2025-10-06 08:06:58 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	96:5vFr1kFCTwwBGDpo/Wm3z28UVRMWOEm98w8QFEYVjxHg02tONIDyLLU2IJf:tFrqqA+/fK8ORMHl85QKdbON6sLo
TLSH	T1CA6321CC7DC2B0E9C7B2D13B089F7055A553BA4158B88A18F26DE4707F9371AA2673A4
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	cocaman
Tags:	AgentTesla iso

cocaman

Malicious email (T1566.001)
From: ""Taha Karim" <info4@perfectsnut.com>" (likely spoofed)
Received: "from mail.perfectsnut.com (unknown [64.72.205.243]) "
Date: "Thu, 2 Oct 2025 19:17:44 -0700"
Subject: "PO-11178 / PR-39316"
Attachment: "PO_11178 PR-39316.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO_11178 PR-39316.js
File size:	5'389 bytes
SHA256 hash:	1497437af6d4c0baeb8d00f785eebe73da5cf4648c518c3c83bfceb6e9860427
MD5 hash:	445bbb7bf433063da022a025ff5cb8db
MIME type:	text/plain
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e378c691bc581176cc4f1f

Tags:

dropper

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

remcos

Link:

https://www.filescan.io/uploads/68e378c67c75fa33a277e5cf/reports/601a85ee-d119-4f90-8f11-123bd18f7383/overview

Verdict:

Malicious

Labled as:

JS/Agent.DFS

Link:

https://www.hybrid-analysis.com/sample/fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98

Verdict:

Malicious

File Type:

iso

First seen:

2025-10-02T08:46:00Z UTC

Last seen:

2025-10-02T08:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98/

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98

Threat name:

Script-JS.Downloader.Remcos

Status:

Malicious

First seen:

2025-10-02 11:09:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

11 of 37 (29.73%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7yzjexzrrzc5ih4bemyrru3jlruhztmz2a27ig256jy4qdcfx6ma._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/251006-k62phssmx5/

Behaviour

Command and Scripting Interpreter: JavaScript

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/fe32925f318e45d41f81233118d3695c687ccd99d035f41b5df271c80c45bf98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_VBS_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contain VBS functions
Reference:	Internal Research