MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9f450849bdabf1dcd77e0c0d1d6a16d4599df470d67a0fdcffbb97cd0f7308. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9f450849bdabf1dcd77e0c0d1d6a16d4599df470d67a0fdcffbb97cd0f7308
SHA3-384 hash: b9fed4f8fa9ef09b7e91800ddbb9a995f0c1d2148b105d2b085ea4097fcf410769291bd9606f7c436a734ebd5ea76186
SHA1 hash: 2f8a425e71eebc2c865b3fb2a4a125fc72435c2e
MD5 hash: cb473279e1c5738ac710668b57e81bdd
humanhash: batman-beryllium-earth-queen
File name:PO07950X.img
Download: download sample
Signature FormBook
Create hunting rule
File size:475'136 bytes
First seen:2020-07-22 08:13:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:NZkjbSthblPKL6PUm2GhNAr/lvlfEdfAt7lenblMcjJkq3hixOEyHQ0m6:NKjbStk6PUm2iNSAeenb/jZwOEyHQ
TLSH 9CA4AD38E7F807D5D7A55BBAE07122A05BBB751A53EAD20D2B55F0DC0A32B804713E27
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: wisxel.com
Sending IP: 5.206.227.51
From: Jorge <engineering@oberdin.it>
Subject: Fw:Re:Re: Container shipment order clear PO009844132
Attachment: PO07950X.img (contains "PO07950X.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9f450849bdabf1dcd77e0c0d1d6a16d4599df470d67a0fdcffbb97cd0f7308/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:15:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2pukccjxwv7dxgxpyga2hlkc3kfthpuodlhud64765zptipomea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 6e9f450849bdabf1dcd77e0c0d1d6a16d4599df470d67a0fdcffbb97cd0f7308

(this sample)

FormBook

Executable exe 8b379923380c07a3447ec8dcba32e4522102f3e5a9b40ce74afd32bcc1d074e6

  
Dropping
MD5 a3dc46c0e95c15e0fa74ed42f8a7b798
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b379923380c07a3447ec8dcba32e4522102f3e5a9b40ce74afd32bcc1d074e6

Comments