MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2550ca65731cebf152a051a62b1e1bf0b6a7138089fec539bcfcc69f4c2d2325. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2550ca65731cebf152a051a62b1e1bf0b6a7138089fec539bcfcc69f4c2d2325
SHA3-384 hash: 2f024c04dd7eb41a5553fa1ee07ea249e38cfd24f2c1f6fac74026d746032b735e6bcc0c986da57dd200599dcab833dd
SHA1 hash: 2687b86a24d68ebd81646865e185871af90b41ee
MD5 hash: a7f5b0bcb1e0ac0cc017d8ef4ad79949
humanhash: pip-tennessee-arkansas-low
File name:PO 15072020.docx.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-17 06:54:01 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:Abl/N9DojacDRY4EcmZHAFaxmVmie9bngPj6nnjqKoe:AZ/0jan4EcmZHAFaxmVmie9bngPOjqKh
TLSH EF457D4A38C0C7DDCEE94AFA5115880433D69F7F8508960BAFAF36D26BD9BD21C1161B
Reporter abuse_ch
Tags:FormBook Hostwinds iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-759308.hostwindsdns.com
Sending IP: 104.168.213.29
From: sales@interflow-th.com <info@crio2.com>
Subject: Confirm PI
Attachment: PO 15072020.docx.iso (contains "PO 87009804.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.HEUR.QVM03.0.4CC8.Malware.Gen.5267.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2550ca65731cebf152a051a62b1e1bf0b6a7138089fec539bcfcc69f4c2d2325/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 05:20:03 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=evimuzltdtv7cuvakgtcwhq36c3koe4arh7mkon47tdj6tbnemsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/2550ca65731cebf152a051a62b1e1bf0b6a7138089fec539bcfcc69f4c2d2325

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso 2550ca65731cebf152a051a62b1e1bf0b6a7138089fec539bcfcc69f4c2d2325

(this sample)

FormBook

Executable exe dd2d045e12c4a515af87ddd17edf5c8f93494f6b99f099b4808c4d0c61daf999

  
Dropping
MD5 cee73e85052102e9d33f0873665e5cb4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd2d045e12c4a515af87ddd17edf5c8f93494f6b99f099b4808c4d0c61daf999

Comments