MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af
SHA3-384 hash: d081fdd9e983adf2684540d07fc62e44c8077d2b1218dd5a950cb29c8b2f9ca112f448c5dfc8536d7bf9a1e71b5c0186
SHA1 hash: 20266a474de807b7bdf76323fce5d2c0055f160a
MD5 hash: fd909db104f4ae9ede6c1c320cdf69c7
humanhash: xray-wisconsin-music-idaho
File name:QUOTE REQUES__pdf_________________________________.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:589'824 bytes
First seen:2022-02-03 08:11:14 UTC
Last seen:2022-04-20 09:50:42 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:CV7p3jchxySDy8Wuj+xFA+UfBQgJxOz8qbBQE2JBlG8d1k8YwS5gJ:IchxySDy8Wuj+xFA+Uf2gJxOrbBQdJGW
TLSH T189C4E0A1F6965591F52A96316136BC5106773EE3AEC2DA18332CF24C0BF32904E76B4F
Reporter cocaman
Tags:FormBook iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Sadique <training_service@amtc-yemen.com>" (likely spoofed)
Received: "from bosmailout04.eigbox.net (bosmailout04.eigbox.net [66.96.189.4]) "
Date: "Thu, 03 Feb 2022 02:22:32 -0500"
Subject: "QUOTE REQUEST"
Attachment: "QUOTE REQUES__pdf_________________________________.iso"

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_pdf.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 08:12:13 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
12 of 27 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwmbg7l6aanhiwwrl62ejm7xtdm5lrfru2qcpttbykb4pkrguwxq._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:ihg0 loader persistence rat
Link:
https://tria.ge/reports/220203-j3vlcsefc7/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Deletes itself
Sets service image path in registry
Xloader Payload
Xloader
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af

(this sample)

Formbook

Executable exe db93a8cf5c8b72db62392b79b6d89f329801525af7a07e920505068922d00cc3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db93a8cf5c8b72db62392b79b6d89f329801525af7a07e920505068922d00cc3

Comments