MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f17dcaa1777680c1c43b83623e69247efc7e44250c52494777ef25cf3b2c2a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f17dcaa1777680c1c43b83623e69247efc7e44250c52494777ef25cf3b2c2a2
SHA3-384 hash: 06dca81d19f0ba5a84e6a36174179be5c99b977e1382ce1a0a25fe17d297ead628b19583018ed625d4197d21fa59aafc
SHA1 hash: d74319abb29ac9010d3477624231f030a5b73461
MD5 hash: f475e92a2ad1422d1ee768a42031287c
humanhash: artist-september-papa-massachusetts
File name:Emailing Swift.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2022-01-15 07:21:44 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:iXvVrDteFiXH0lIlZDWuy4mSfP+CN287RIQnnC5JM1LvMm:iNPtecthVPf2C5IQnC5JA
TLSH T18545020273F80A98EDFE43B6256A6214577976071632E71C3D8D31DD0BF7B429A02BA7
Reporter cocaman
Tags:FormBook img INVOICE SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "Fast e-Invoice <einvoice@fastsoftware.com.vn>" (likely spoofed)
Received: "from fastsoftware.com.vn (unknown [45.137.22.35]) "
Date: "14 Jan 2022 16:46:33 +0100"
Subject: "=?UTF-8?B?UmU6IENvbmZpcm1hY2nDs24gZGUgdHJhbnNmZXJlbmNpYQ==?="
Attachment: "Emailing Swift.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1156.26418.12790.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook obfuscated packed print.exe
Link:
https://www.filescan.io/uploads/61e2761ff2e8ec86fe00a067/reports/b165bbb9-6ef1-414c-af4f-d706dd9e19cb/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f17dcaa1777680c1c43b83623e69247efc7e44250c52494777ef25cf3b2c2a2/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-01-15 07:22:13 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
17 of 43 (39.53%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n4l5zkqxo5uayhcdxa3chzusi7x4pzcckdcsjfdxp3zfz45sykra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/6f17dcaa1777680c1c43b83623e69247efc7e44250c52494777ef25cf3b2c2a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 6f17dcaa1777680c1c43b83623e69247efc7e44250c52494777ef25cf3b2c2a2

(this sample)

Formbook

Executable exe 3802c17da19f4b86af70916d72948d6a73d6c388efdbae0598fdefc0ea0a5741

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3802c17da19f4b86af70916d72948d6a73d6c388efdbae0598fdefc0ea0a5741

Comments