MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fac4ba0692fa25f7197126f54f42a5f33c82bd04adb2a5bbede2b95ef545da0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fac4ba0692fa25f7197126f54f42a5f33c82bd04adb2a5bbede2b95ef545da0
SHA3-384 hash: 93da40455979be07aa110a3a118d406ebcce3d416a6492ece633d67d52a4c34a0cbbd23ec11475af1373c6794f3c12a2
SHA1 hash: ff622974117df2bccd9789eeee441d41cc8ba533
MD5 hash: 7f5a85d086a8b0b2ff844aa38d03d90f
humanhash: march-foxtrot-timing-neptune
File name:DHL-DOCS 122020.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'966'080 bytes
First seen:2020-12-04 21:17:34 UTC
Last seen:2020-12-05 07:16:23 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ZT+3dRne7vY6IQm06+Y14lpZ29KXmcJc8hkKd+zST0sDd:ZK3dhe7vY6IQm0w1upZKKWcTd+GT0Ad
TLSH DC95076D7A5076EEE467C93ECAA81C64EB9875B7930BC547A07305DC9B0E847CF900B2
Reporter cocaman
Tags:DHL FormBook iso Maersk


Avatar
cocaman
Malicious email (T1566.001)
From: "A.P. Moller - Maersk <operations@gmail.com>" (likely spoofed)
Received: "from gmail.com (unknown [172.93.220.44]) "
Date: "05 Dec 2020 00:07:57 +0100"
Subject: "RE : URGENT!!! 2 x 20ft - SHIPPING DOC BL, SI, INV#462345 // MAERSK KLEVEN V.949E // CLGQOE191781 //"
Attachment: "DHL-DOCS 122020.ISO"

Intelligence

File Origin
# of uploads :
2
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.th.17524.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fac4ba0692fa25f7197126f54f42a5f33c82bd04adb2a5bbede2b95ef545da0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-04 21:18:05 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6wexidjf6rf64mxcjxvj5bkl4z4qk6qjlnsuw563yvzl32ulwqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fac4ba0692fa25f7197126f54f42a5f33c82bd04adb2a5bbede2b95ef545da0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 7fac4ba0692fa25f7197126f54f42a5f33c82bd04adb2a5bbede2b95ef545da0

(this sample)

Formbook

Executable exe e4a37068ee17c112f9d33e3151e260f85e9a8b200b4958caf569cf6076447ea1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4a37068ee17c112f9d33e3151e260f85e9a8b200b4958caf569cf6076447ea1
  
Dropping
Formbook

Comments