MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19c8a000157a1574162a4e7b0e30ff7fd825de4e4b91cf25e13ec16d19580a5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 10 File information Comments

SHA256 hash:	19c8a000157a1574162a4e7b0e30ff7fd825de4e4b91cf25e13ec16d19580a5b
SHA3-384 hash:	dc877ad3a65c44c30de0279ad7e98c589dac6c82a2d553d971804af95b5eb0e8815c1497e5fe21ec97ddde03d2f58be3
SHA1 hash:	acfa93919e720b0043391891430cbd903442838d
MD5 hash:	6857afc60f8322f1500f277696062899
humanhash:	magazine-quiet-high-india
File name:	statement of account.img
Download:	download sample
Signature	Formbook Create hunting rule
File size:	1'769'472 bytes
First seen:	2024-12-02 12:13:01 UTC
Last seen:	2024-12-02 15:25:46 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	24576:ku6J33O0c+JY5UZ+XC0kGso6FasMYlEr6wkpttEq2qMBxvWY:eu0c++OCvkGs9FasBKrpkpt52qMB8Y
TLSH	T10185CF22B3DDC361CB669173BF69B7016EBF3C210630B95B2F980D7DA960161162D7A3
TrID	47.7% (.ISO/UDF) UDF disc image (2114500/1/6) 46.2% (.NULL) null bytes (2048000/1) 5.7% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.1% (.ATN) Photoshop Action (5007/6/1) 0.0% (.ISO) ISO 9660 CD image (2545/36/1)
Magika	iso
Reporter	cocaman
Tags:	FormBook img

cocaman

Malicious email (T1566.001)
From: "Tahani Al Hasani <tahani@mezooninternational.com>" (likely spoofed)
Received: "from mezooninternational.com (unknown [185.222.58.249]) "
Date: "2 Dec 2024 07:23:25 -0800"
Subject: "FW: statement of account"
Attachment: "statement of account.img"

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	STATEMEN.EXE
File size:	1'207'296 bytes
SHA256 hash:	330de92b6b1ad574f55e91be0b48a2b1fa8f90ad27cec182290927999d9d828d
MD5 hash:	8fd1423bdc7159efa289aaef4c493da8
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30424.BadIso.UNOFFICIAL

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674da5aa04c232bff3b5e6b4

Tags:

autoit emotet

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

autoit compiled-script context-iso fingerprint fingerprint keylogger lolbin microsoft_visual_cc netsh packed packed packer_detected wuauclt

Link:

https://www.filescan.io/uploads/674da451bf62015002e6aa44/reports/009e1a96-48e0-4166-9230-ab2ac44354ce/overview

Verdict:

Suspicious

Labled as:

AutoIt.OL.gen

Link:

https://www.hybrid-analysis.com/sample/19c8a000157a1574162a4e7b0e30ff7fd825de4e4b91cf25e13ec16d19580a5b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/19c8a000157a1574162a4e7b0e30ff7fd825de4e4b91cf25e13ec16d19580a5b/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-12-02 05:32:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dhekaaavpikxifrkjz5q4mh7p7mclxsojoi46jpbh3aw2gkybjnq._file

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/19c8a000157a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/19c8a000157a1574162a4e7b0e30ff7fd825de4e4b91cf25e13ec16d19580a5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	AutoIT_Script Create hunting rule
Author:	@bartblaze
Description:	Identifies AutoIT script. This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	SUSP_Imphash_Mar23_3 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Reference:	Internal Research

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)