MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 515817492a133c4e32e4ecb84081bd363dedbd19f1c1c3083384d3a98746d352. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 515817492a133c4e32e4ecb84081bd363dedbd19f1c1c3083384d3a98746d352
SHA3-384 hash: f003cc22a994fce2162872154be5e50f5aa7195ed53fdd8e958c109a4d839f8ea9b4cc76b2985f04486b4fd08e0178dc
SHA1 hash: ca76df1132c2d8b3ca73b3cdebd8fc5dee8a274d
MD5 hash: 65c47f9cda7fb8a122f0a5c4e229faa3
humanhash: burger-six-mobile-mississippi
File name:First Bulk Order 3483403.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'507'328 bytes
First seen:2022-07-19 15:16:28 UTC
Last seen:2022-07-19 16:14:06 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:u6x+g9HRYFuETgOPb2M+Sgu7DSnFZDnYTikyzbH0ywnAwDxcAiZ9dn7y0tVSn524:u+DRYEETgOPb+Sgu7I/DnYsHH0ywn3D5
TLSH T17A658D21F2B1CC33D063167E5D5B72A46D2EBE412A29F9856AE83D4C1FF868138653C7
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "sgarbo@biznetvigator.com" (likely spoofed)
Received: "from [141.98.6.40] (unknown [141.98.6.40]) "
Date: "19 Jul 2022 16:47:13 +0200"
Subject: "RE:RE: First Bulk Order 36787403"
Attachment: "First Bulk Order 3483403.img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2232.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Win32.Injector.51f4b042.22291.29423.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger obfuscated packed wacatac
Link:
https://www.filescan.io/uploads/62d6cb7561945a46c8d51556/reports/a0d1ee71-fdf9-4412-bfe8-26d16a15f996/overview
Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/515817492a133c4e32e4ecb84081bd363dedbd19f1c1c3083384d3a98746d352/
Threat name:
Win32.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2022-07-19 06:14:50 UTC
File Type:
Binary (Archive)
Extracted files:
41
AV detection:
20 of 40 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kfmbosjkcm6e4mxe5s4eban5gy663piz6ha4gcbtqtj2tb2g2nja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/515817492a133c4e32e4ecb84081bd363dedbd19f1c1c3083384d3a98746d352

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 515817492a133c4e32e4ecb84081bd363dedbd19f1c1c3083384d3a98746d352

(this sample)

Formbook

Executable exe 70b0584e7af38f6a3df03120166a1378819bf596d6e5d5f1cf64cd3280b2ca61

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 70b0584e7af38f6a3df03120166a1378819bf596d6e5d5f1cf64cd3280b2ca61
  
Dropping
Formbook

Comments