MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 182479a6d2b851cdbffca7fa9dbee343d2ca89ff25dbb59858352793179f9688. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 182479a6d2b851cdbffca7fa9dbee343d2ca89ff25dbb59858352793179f9688
SHA3-384 hash: f6822a30974a183d972e6c1cd6608dc5787e190549b8ccc1556b07cfb67f2b677d5ad501cf00f5319cb41b3fe05af9dd
SHA1 hash: 5a0f54d11eea062b13e0ddf38f7b764e40172254
MD5 hash: d0198e2a3d140dccd82d3d0634d68594
humanhash: beryllium-nitrogen-rugby-freddie
File name:payment.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-26 06:42:35 UTC
Last seen:2021-02-26 19:31:22 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:uCbYQjoiuM3JGLXzKjtaAzi+9ZskAZnreR:uCbYQjoBM3JGLXzorZAtr
TLSH AD45F19C890DC3E2E86572FC531B13ACE5619D9EA9C6F1193B3ED9D00787B5C18B18B8
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: box.hertmans.xyz
Sending IP: 143.198.28.9
From: Accounting Technician<info@hertmans.xyz>
Reply-To: <supplyensh@gmail.com>
Subject: RE: RE:PAYMENT DETAILS
Attachment: payment.IMG (contains "RAQ11986.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.10883.7914.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/182479a6d2b851cdbffca7fa9dbee343d2ca89ff25dbb59858352793179f9688/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:43:08 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dashtjwsxbi43p74u75j3pxdipjmvcp7exn3lgcygutzgf47s2ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 182479a6d2b851cdbffca7fa9dbee343d2ca89ff25dbb59858352793179f9688

(this sample)

Formbook

Executable exe b32d120bf6320cf1d2d2223ad2a797eb0c20efceb12bd0655642387452ef3b6e

  
Dropping
MD5 725cb0465119c2d5cc1412e3d555ad04
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b32d120bf6320cf1d2d2223ad2a797eb0c20efceb12bd0655642387452ef3b6e

Comments