MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375b5662e50b9a4f99cd6d8d31856bc21274374fea6de33888558cb4b0ef746d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 375b5662e50b9a4f99cd6d8d31856bc21274374fea6de33888558cb4b0ef746d
SHA3-384 hash: 0237eb5e5af98228220484673c230a003d46451215df2e7dd6fb446a9e316e180a00320e2a1ed358c9ac1b78c03cf824
SHA1 hash: f657910d25688879c9bfe25b6b32f0765e87c78b
MD5 hash: 9acf687724869230d1f7aacc98fb7fb9
humanhash: india-oven-fanta-oklahoma
File name:HSBC payment transfer 14-08-202210.50.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2022-08-16 17:54:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:T85TKGVtt3gmitQpqMHkOUAVtRhU1Nf6DooqRwELj:QVvHFp/HFhsNf6DooOL
TLSH T14F55DFEEDEF92956DE20017AF26866AC37D11D24A823C31E9A4BF68D65733CC4465F03
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:FormBook HSBC img payment


Avatar
cocaman
Malicious email (T1566.001)
From: "Hassan Ahmed <hassan@maqadhe.com>" (likely spoofed)
Received: "from maqadhe.com (unknown [45.137.22.93]) "
Date: "14 Aug 2022 11:08:14 +0200"
Subject: "RE: RE: HSBC payment transfer Scan copy 14-08-202210.50"
Attachment: "HSBC payment transfer 14-08-202210.50.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
294
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.40279.30744.8587.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed wacatac
Link:
https://www.filescan.io/uploads/62fbda6e7a5eee5048125967/reports/c18efb30-8457-47dc-aec8-87b0fb269a17/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/375b5662e50b9a4f99cd6d8d31856bc21274374fea6de33888558cb4b0ef746d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-14 08:04:10 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5nvmyxfbone7gonnwgtdbllyijhin2p5jw6goeikwgljmhporwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/375b5662e50b9a4f99cd6d8d31856bc21274374fea6de33888558cb4b0ef746d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 375b5662e50b9a4f99cd6d8d31856bc21274374fea6de33888558cb4b0ef746d

(this sample)

Formbook

Executable exe 7abf15d375e9feae83604e3fd3aa96492fa260ae8e45ddecdb0e6658db77278f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7abf15d375e9feae83604e3fd3aa96492fa260ae8e45ddecdb0e6658db77278f
  
Dropping
Formbook

Comments