MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 770334050f8db35fdad80d079ee15e966fc7897b532ce95b2c6efaf494146936. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 770334050f8db35fdad80d079ee15e966fc7897b532ce95b2c6efaf494146936
SHA3-384 hash: f87e730769493a65b9da846010851ed05b1c0ab6028166a4af9330ebae1fc67494d94dbfd8c6592e0536bf20e7618dde
SHA1 hash: d49c85edbea2dded7f9fdb60ce17c5323efe6bdf
MD5 hash: 66a9ceda95f7521a52a26bd4852458a5
humanhash: comet-salami-nebraska-moon
File name:Revised PI 8292022.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2022-08-30 13:17:46 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:o75LBuZV2nmI5jGOOR4512Yf/BS4V3og1:yLBu/2npjDOq1LIw3
TLSH T19745120A33E49AAAC6EE4BF461A191D14375B30B1013D73E3D5C26DC0F663D2865A7AF
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Summer Lin <summer@mlmfurniture.com>" (likely spoofed)
Received: "from mlmfurniture.com (unknown [45.137.22.61]) "
Date: "29 Aug 2022 06:44:59 +0200"
Subject: "Re: REVISED THE PROFORMA updated PI 8292220"
Attachment: "Revised PI 8292022.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1427.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630e0e23fbf1afa49279e12d/reports/318bd4fc-63d8-45f4-a51c-65d5ca95ff10/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/770334050f8db35fdad80d079ee15e966fc7897b532ce95b2c6efaf494146936/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-08-29 05:04:07 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4btibiprwzv7wwybudz5yk6szx4pcl3kmwoswzmn35pjfaune3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/770334050f8db35fdad80d079ee15e966fc7897b532ce95b2c6efaf494146936

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 770334050f8db35fdad80d079ee15e966fc7897b532ce95b2c6efaf494146936

(this sample)

Formbook

Executable exe ad3c80c0e26e7e240ceee2775462339773beef293255a07f2280649f441d0fb6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad3c80c0e26e7e240ceee2775462339773beef293255a07f2280649f441d0fb6
  
Dropping
Formbook
  
Dropping
MD5 43594bfa34f67533d3b6aba676c717bd

Comments