MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62fdd70c1344cc79f07897a93c2112b6561c3e2646f82f6b16dc09bc56fd9e55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62fdd70c1344cc79f07897a93c2112b6561c3e2646f82f6b16dc09bc56fd9e55
SHA3-384 hash: c544a69ef9989452e1dd877d374dc65dfb62c630f4e76c3626688a29cbc32922f6506f2edf6d030ac886e06eba4eee7c
SHA1 hash: cfc19d2f82d375876fac1cc608d1ce5c17fc9e03
MD5 hash: 8e4ddee0323f9802b7713ad8955fa2d1
humanhash: oranges-avocado-oscar-carbon
File name:swift.05fd90a7-b0d0-49e8-9d15.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:624'873 bytes
First seen:2021-01-19 06:27:13 UTC
Last seen:2021-01-20 19:42:30 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:8UKOSkJ6p39frK+tEHljyQDmWLoQlgfzipXG3OeVMpJhtyqVjVcPxOrv:80SSetTBhQi3QifzFUpBy6jVcJOrv
TLSH 96D423150DE6264A58178E61FD85427ADFA01FEBB18D0C31E98AE0E7C7C1CCA2779E5C
Reporter cocaman
Tags:SWIFT zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""youyoung01@youyoungtx.co.kr" <kacha@brooksshaun.xyz>" (likely spoofed)
Received: "from ngay18 (unknown [51.79.140.125]) "
Date: "Tue, 19 Jan 2021 02:29:31 +0100"
Subject: "RE : RE : RE : December SOA - Payment delay"
Attachment: "swift.05fd90a7-b0d0-49e8-9d15.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.20468.16854.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62fdd70c1344cc79f07897a93c2112b6561c3e2646f82f6b16dc09bc56fd9e55/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 06:28:05 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ml65odatitght4dys6utyiiswzlbyprgi34c62yw3qe3yvx5tzkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62fdd70c1344cc79f07897a93c2112b6561c3e2646f82f6b16dc09bc56fd9e55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 62fdd70c1344cc79f07897a93c2112b6561c3e2646f82f6b16dc09bc56fd9e55

(this sample)

Formbook

Executable exe e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e79083b58aae06c0413f65d3979fcad177112e4f49ef3568d0b52392b07ff720

Comments