MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c383a2650fcb6ab1d03185cce59f460192b101f442c18a716d0a560448c8a9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c383a2650fcb6ab1d03185cce59f460192b101f442c18a716d0a560448c8a9a
SHA3-384 hash: 2255f227aae5bbc64ee50a5fd37aa78935bf3b33cce8bc538e07009f1a0dd5f20c353999934a559362c18790bdcd7919
SHA1 hash: 2efc2b82499ae6b3e15f07625373994a06e175d9
MD5 hash: bd84dca2ee24f917709c07bb25a084d0
humanhash: wolfram-happy-vegan-tennessee
File name:SWIFT transferir copia_98087.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:1'282'048 bytes
First seen:2021-02-24 07:06:14 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:OtSq9sj56YkWxQ4r3WFRJaSA/KpS9g3S2hdqEJTt07OkMqk:hEWFCFRJ4/KpS9KNhdL0yd
TLSH AD5538011629BE24F4BD933799A88450EFE9BC10D711C92EF4D87CAE6E71BD2664F207
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: web333.fangio.net
Sending IP: 190.106.131.237
From: Banco Santander <remittance@tecnosorgosa.com.ar>
Subject: MT103 Copia de transferencia de payment
Attachment: SWIFT transferir copia_98087.iso (contains "SWIFT transferir copia_98087.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.22690.11524.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c383a2650fcb6ab1d03185cce59f460192b101f442c18a716d0a560448c8a9a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 05:01:00 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nq4dujsq7s3kwhiddbom4wpumamswea7iqwbrjyw2cswaremrkna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 6c383a2650fcb6ab1d03185cce59f460192b101f442c18a716d0a560448c8a9a

(this sample)

Formbook

Executable exe a0a24af1d7eaf3c0066b417f3f631327af37f5e1e3ee8f79019bade1f700ef69

  
Dropping
MD5 28be14d0f408e1263594adca02ab3289
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a0a24af1d7eaf3c0066b417f3f631327af37f5e1e3ee8f79019bade1f700ef69

Comments