MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2adb8bdadf9867460dedfccd61ab3b0fde0af1211b914611f8ea4920f68eaca8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2adb8bdadf9867460dedfccd61ab3b0fde0af1211b914611f8ea4920f68eaca8
SHA3-384 hash: 97398390e800d6119de0c08a786f0f1f4903edce72cb58116379d20056c3787b0a801bad4edcb3b09385d5860014490d
SHA1 hash: 58fba48328ce1964e3846538636f487adc9bebb2
MD5 hash: d181f7b36ac1fa53299a961be35356c5
humanhash: single-dakota-tango-april
File name:PL PI.img
Download: download sample
Signature FormBook
Create hunting rule
File size:548'864 bytes
First seen:2020-07-21 06:46:08 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:ed9J69kv1PSyRw6TBY1hg1Hhuu4bA4BIWWip4CgAZjaTX8:4X6bkhuu4bA4hWimAZj0s
TLSH A9C45934D7F88AD5E7BA57B9E474014087B7B516A7EAE3482B94F0E918323508B03F66
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: wisxel.com
Sending IP: 5.206.227.51
From: Sarah <komay@mfinterio.com>
Subject: Fw:Re:Re: Container shipment order clear PO009844132
Attachment: PL PI.img (contains "PL PI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.60237.12634.13626.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2adb8bdadf9867460dedfccd61ab3b0fde0af1211b914611f8ea4920f68eaca8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:48:07 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=flnyxww7tbtumdpn7tgwdkz3b7pav4jbdoiumepy5jesb5uovsua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2adb8bdadf9867460dedfccd61ab3b0fde0af1211b914611f8ea4920f68eaca8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 2adb8bdadf9867460dedfccd61ab3b0fde0af1211b914611f8ea4920f68eaca8

(this sample)

FormBook

Executable exe 0707523c23666b0535673287616ea82b34e810594ddf19c45a0746d1bd697070

  
Dropping
MD5 a55080b594286b0ccaf24ea05141293d
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0707523c23666b0535673287616ea82b34e810594ddf19c45a0746d1bd697070

Comments