MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140
SHA3-384 hash: c6ce975823d8c373e2d2befa840a86582ee49b4016e31ce8c4a2a604b2b3c66b82afca4e5fa7fb75ee357b54e289897e
SHA1 hash: 411c5bc2de4195f0203e56d159fab107967df12c
MD5 hash: b52385c57e9435c61f5839c1255d5a1c
humanhash: washington-ink-early-lake
File name:TekT_0136205,pdf.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'036'288 bytes
First seen:2022-03-15 11:56:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:xK+zGJm7It0lB/ni3jEE6zpeZp0nxpxkih:Y+KJm7y03/Ae4ynx
TLSH T15125AFE96EB555F2F26F16BD08A79A78C291EF51D671611E3C2C825087FFA00C0FB606
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?Q?Erol_S=C3=96YLER=C4=B0Z?= <erol@kg.ac.rs>" (likely spoofed)
Received: "from wm1.unic.kg.ac.rs (webmail.kg.ac.rs [147.91.209.114]) "
Date: "Tue, 15 Mar 2022 12:54:58 +0100"
Subject: "RE: Offer/Quotation required"
Attachment: "TekT_0136205,pdf.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/62307edcdfdfa8501ca3a1bf/reports/8fbb2fdb-ac7a-4e14-b36f-238b2d819a0a/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 11:56:13 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
7 of 40 (17.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtabwyobq37x65q3nit44mmogtmwhkentykw2t4jaylszoqkgfaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 8cc01b61c186ff7f761b6a27ce318e34d963a88d9e156d4f8906172cba0a3140

(this sample)

Formbook

Executable exe 143b1ed85fcc55420dcabccf16e229733eef4a3345c1a82ef4d668242fc2b700

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 143b1ed85fcc55420dcabccf16e229733eef4a3345c1a82ef4d668242fc2b700

Comments