MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a
SHA3-384 hash: 7cc5e3fa412329023bc80875f632d8097977d1a213784e33f851922466520a1dd7456e4c4257c1f2f3e86c20958d4ce9
SHA1 hash: 4fd32cc6ccaa572e64813e3dde49367717189bcd
MD5 hash: 3ca7b06207330b329d9431ec99203695
humanhash: massachusetts-georgia-chicken-beer
File name:transferir copia_98087.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:528'384 bytes
First seen:2021-02-23 16:19:10 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Mr3++81XB6UShhRodjvFfWMyYNkdEK+7Wiv60O:Gf81XBwEdjvVfo+CJ
TLSH 01B4BE05229C621CE47E76368AB0654F97F7BE119663D56F3CEC224F0F72E848B2171A
Reporter abuse_ch
Tags:ESP FormBook geo iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: web333.fangio.net
Sending IP: 190.106.131.237
From: Banco Santander <remittance@tecnosorgosa.com.ar>
Subject: Copia de transferencia de pago
Attachment: transferir copia_98087.iso (contains "transferir copia_98087.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.ZTAtr.5837.9055.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 15:01:06 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gft2glihlu6drugdbutu75i3zn32eplumv4i4kk2gvjvkzado5va._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 3167a32d075d3c38d0c30d274ff51bcb77a23d7465788e295a3553556403776a

(this sample)

Formbook

Executable exe a3327c95da3017b7f9f87eeeef8ccba7373e363facad5024432b7aba20a9b832

  
Dropping
MD5 ca35b660415defe96fe6af4eb3a45d86
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a3327c95da3017b7f9f87eeeef8ccba7373e363facad5024432b7aba20a9b832

Comments