MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 597a276afd2330017ecb8973aab0e12d241ef4f007da014591ef2ce33eccb42c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	597a276afd2330017ecb8973aab0e12d241ef4f007da014591ef2ce33eccb42c
SHA3-384 hash:	293b45bc2fec7ccfb1336b4e93e8d336744989ac273e9ae39026b240620e27e2b725796bbe57e820c0ba847694c92991
SHA1 hash:	c54ddfa26002cff8a5cc02a9bbc25c0aff2da10a
MD5 hash:	2243e6a2239f21d36d6213139a2b6057
humanhash:	maine-network-oregon-tennessee
File name:	INV 174 & INV 108-2022.img
Download:	download sample
Signature	Formbook Create hunting rule
File size:	126'976 bytes
First seen:	2022-08-29 14:56:06 UTC
Last seen:	Never
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	3072:+iHT5TqpZKX+DKhN4fEeZGm/yg87hIMDCx7v5zKS2OVHxIh5ac3y:F
TLSH	T117C352A0F245C8DAE86661B58C5FDD201153A6ADD4B1461E309F7B3AABF335310A7B0F
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	FormBook img

cocaman

Malicious email (T1566.001)
From: "Oliver E. Sayno <sale@shopboard.ru>" (likely spoofed)
Received: "from vip42.hosting.reg.ru (vip42.hosting.reg.ru [31.31.196.60]) "
Date: "25 Aug 2022 00:38:53 +0200"
Subject: "Lgpartner DRTS Co. - INV 174 & INV 108-2022 ready at 8/25/2022 12:38:52 a.m."
Attachment: "INV 174 & INV 108-2022.img"

Intelligence

File Origin

# of uploads :

# of downloads :

289

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL

TwinWave.EvilDoc.PkillISOStopTheClocks.20211020.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/630cd416a7450371f688de02/reports/f899c5a5-8b40-4f2e-87b7-e24948fdbddc/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/597a276afd2330017ecb8973aab0e12d241ef4f007da014591ef2ce33eccb42c/

Threat name:

ByteCode-MSIL.Downloader.Wagex

Status:

Malicious

First seen:

2022-08-25 00:42:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 40 (42.50%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lf5co2x5emyac7wlrfz2vmhbfusb55hqa7nacrmr54wogpwmwqwa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/597a276afd2330017ecb8973aab0e12d241ef4f007da014591ef2ce33eccb42c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research