MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 661eda3234e1b3b497701920414c03108188d4e4cadc8a3de7dbda17753c9e09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 661eda3234e1b3b497701920414c03108188d4e4cadc8a3de7dbda17753c9e09
SHA3-384 hash: 9a2f419440449b0858e48a894986bb928232793668a1972b017c554bb8da121215e231e54f6eafc6d57cae51144bc739
SHA1 hash: 07c460596177a5c2ef06e16a38658112348a5c79
MD5 hash: 4ad9a15626677976b84e54ea4dde0420
humanhash: fanta-saturn-neptune-dakota
File name:doc001876543456781987651000_pdf .img
Download: download sample
Signature Formbook
Create hunting rule
File size:940'032 bytes
First seen:2022-06-03 13:35:15 UTC
Last seen:2022-06-03 13:36:03 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:h2/pKmJAagHvRnAmqgc/SdORHmV1ujAcV0szEZbnRQuNbNhPDDSXG:h2/pL+RvCT/SoRHmKgszEZNZH4G
TLSH T143157B4339DC47DDD5A306F26C71F320212E7E0F86958E8ABED7AA0D956128846793CF
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Simon Gschier <sg@schneider-peklar.at>" (likely spoofed)
Received: "from schneider-peklar.at (unknown [195.242.111.106]) "
Date: "3 Jun 2022 05:23:26 -0700"
Subject: "AW: AW: AW: Re:"
Attachment: "doc001876543456781987651000_pdf .img"

Intelligence

File Origin
# of uploads :
2
# of downloads :
561
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts62.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm control.exe obfuscated packed replace.exe
Link:
https://www.filescan.io/uploads/629a0e582dac0ae8c9034e81/reports/267db507-1614-49b0-9000-033b6458854f/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/661eda3234e1b3b497701920414c03108188d4e4cadc8a3de7dbda17753c9e09/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-03 09:55:02 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
17 of 40 (42.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mypnumru4gz3jf3qdeqectadccayrvhezloiupph3pnbo5j4tyeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/661eda3234e1b3b497701920414c03108188d4e4cadc8a3de7dbda17753c9e09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 661eda3234e1b3b497701920414c03108188d4e4cadc8a3de7dbda17753c9e09

(this sample)

Formbook

Executable exe c40018a8c58d463f829a97d5c5280c2b5292573cbd321f042e7225db4bff6d95

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c40018a8c58d463f829a97d5c5280c2b5292573cbd321f042e7225db4bff6d95
  
Dropping
MD5 862a815ffdf58d6c2ae62a2948658e74

Comments