MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99b3448bac3e6c4b38fd84e730b889d0a7e587ff09718c20d4ef635e99516d09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 99b3448bac3e6c4b38fd84e730b889d0a7e587ff09718c20d4ef635e99516d09
SHA3-384 hash: 48734ea7c0ff59dde59931e19fadf7de53849e768c3668b4e6bd4e8ceddb9b10a2782199bded57595c5dbe3600e7ae9c
SHA1 hash: b1aa96d1ef48f23c6e77244526a7b8b580da9dd2
MD5 hash: a47eca19a87ab72ae141ab8ac1ad4357
humanhash: friend-lemon-video-oxygen
File name:newordermx.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'024'000 bytes
First seen:2021-04-06 08:14:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:/iIHRB51/ZaQksYtx2zVgO8nXPn3TbXeUfb0:nRT2QksYT2zVgOSP3nu0
TLSH B525022223548789F07E6730153151D607F3FD22EB36E22D7DA9718A9F76980C5A2BE3
Reporter abuse_ch
Tags:FormBook img SendGrid


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: wrqvfdrw.outbound-mail.sendgrid.net
Sending IP: 149.72.253.89
From: info@quentysafit.com
Subject: Fw: RE: BA-S-20-3563-MX FOR PAYMENTS INVOICE
Attachment: newordermx.img (contains "newordermx.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/99b3448bac3e6c4b38fd84e730b889d0a7e587ff09718c20d4ef635e99516d09/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 03:34:26 UTC
AV detection:
1 of 48 (2.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tgzujc5mhzwewoh5qtttboej2ct6lb77bfyyyigu55rv5gkrnueq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/99b3448bac3e6c4b38fd84e730b889d0a7e587ff09718c20d4ef635e99516d09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 99b3448bac3e6c4b38fd84e730b889d0a7e587ff09718c20d4ef635e99516d09

(this sample)

Formbook

Executable exe c1bcc9edb69c75aa2e1052ef728392ca9a922a23888a4be835e0bc4dbd150752

  
Dropping
MD5 2709bbb82baaf385a201bff8865e2d65
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1bcc9edb69c75aa2e1052ef728392ca9a922a23888a4be835e0bc4dbd150752

Comments