MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c22b6330a22240a6266a2e4330dda749c43dae45d3bb8a76ee09b1f997255a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c22b6330a22240a6266a2e4330dda749c43dae45d3bb8a76ee09b1f997255a0
SHA3-384 hash: 8b512a58ef9fe5e09a02bfcf58470e491b1534e43c1080d4f0fbddc90b2aa70412124a4b19012e18eac10676552ba429
SHA1 hash: a761dde9bcd3d58d209130d15bf5a7f1cc38e16e
MD5 hash: c7bf4172a1a0a400d872901ac8aaec1c
humanhash: sodium-spring-neptune-berlin
File name:TT Advice Transfer confirmation.r09
Download: download sample
Signature Formbook
Create hunting rule
File size:349'831 bytes
First seen:2022-01-27 09:25:30 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:4lOHL4vs+FBhcOChpljtVNBi14LJx4aszlsrLooV+Fyo6ZgKXToK:4lCL4B09jvVNBi1e4dzlsHL7iK8K
TLSH T17F742306CE63B464556D2DD8E8C700A3EA490BF4464BBE7D9CF794C0223D6852369EEF
Reporter cocaman
Tags:FormBook r09


Avatar
cocaman
Malicious email (T1566.001)
From: "Antoine Gravel-Savard <AGravelSavard@transmag.ca>" (likely spoofed)
Received: "from transmag.ca (unknown [185.222.58.123]) "
Date: "27 Jan 2022 10:07:35 +0100"
Subject: "Re: TT Advice Transfer confirmation"
Attachment: "TT Advice Transfer confirmation.r09"

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/61f265348581cbffe088d007/reports/f031db6f-6ae9-4f5e-8847-f25d353df887/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c22b6330a22240a6266a2e4330dda749c43dae45d3bb8a76ee09b1f997255a0/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-01-27 07:53:32 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
8 of 43 (18.60%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqrlmmykeisauytgulsdgdo2osoehwxelu53rj3o4cnr7glskwqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6c22b6330a22240a6266a2e4330dda749c43dae45d3bb8a76ee09b1f997255a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r09 6c22b6330a22240a6266a2e4330dda749c43dae45d3bb8a76ee09b1f997255a0

(this sample)

Formbook

Executable exe 947781dc2bb16bf085419b1804e568c2a0293423018f4b5e60beda4ed0ae218e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 947781dc2bb16bf085419b1804e568c2a0293423018f4b5e60beda4ed0ae218e

Comments