MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c9f74fcde21bf57e48d027a42d6fd1966e1111ccdeeb0ea9092fbc021c9bd21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c9f74fcde21bf57e48d027a42d6fd1966e1111ccdeeb0ea9092fbc021c9bd21
SHA3-384 hash: e4d5074435a81e254eb8508ad69ea3f71b7d5a56da6338cb89ea0600b1276550718da17fed8a11f674f416cbe4b8cdac
SHA1 hash: 3a1dc05cc5fe4ace1a3d0d66e81b06e1238eb9b4
MD5 hash: 598000e1ab79990a885c63136db8c0f2
humanhash: helium-idaho-whiskey-fourteen
File name:doc0987654345678900987654 .img
Download: download sample
Signature Formbook
Create hunting rule
File size:81'920 bytes
First seen:2022-08-30 13:15:25 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 192:wbhpgSET2bhYcLLoDo8qRcOB8t/H1d3YUziJ2hLD/+:QDET2bh9LLoDSCzF/P/
TLSH T1BA835E1267A8C66DDAE91B7928721354066BBD40B671CE2EF4DC711F8FB32C186427E3
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "M. Ganthaler <produzione2@eurotecriga.com>" (likely spoofed)
Received: "from mail.virtualchurchprograms.com (unknown [5.252.23.215]) "
Date: "28 Aug 2022 23:07:44 -0700"
Subject: "R: INQ ORD 45600"
Attachment: "doc0987654345678900987654 .img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.Kryptik.AGGH.432569.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630e0e1ba7450371f68df137/reports/4123df73-3117-42e1-9409-fc6f75669ce0/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c9f74fcde21bf57e48d027a42d6fd1966e1111ccdeeb0ea9092fbc021c9bd21/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 05:47:33 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 41 (43.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lspxj7g6eg7vpzenaj5efvx5dftocei4zxxlb2uqsl54aiojxuqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5c9f74fcde21bf57e48d027a42d6fd1966e1111ccdeeb0ea9092fbc021c9bd21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 5c9f74fcde21bf57e48d027a42d6fd1966e1111ccdeeb0ea9092fbc021c9bd21

(this sample)

Formbook

Executable exe 9c16b8c4e8821ebc5a1464e2032ec7ee107d9d873de7ea07cf42778d307fe751

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c16b8c4e8821ebc5a1464e2032ec7ee107d9d873de7ea07cf42778d307fe751
  
Dropping
Formbook

Comments