MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c4656ba0f3dcd7ceed54c6da324ea9b783f8f5f5e9306ea5be9b38e2deb23e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c4656ba0f3dcd7ceed54c6da324ea9b783f8f5f5e9306ea5be9b38e2deb23e6
SHA3-384 hash: a7f95b5dafbc04fdc63b48266bfbc7c748b93946006d6cbdb126869a13adb1fd35462f75161c29b63beabb18e3909a07
SHA1 hash: a0f3ff19119ea3b810acd97c22af4d5571e38bed
MD5 hash: a423ae56f2efa98e716291be24f33871
humanhash: quebec-vermont-queen-mirror
File name:PROOF OF PAYMENT.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'638'400 bytes
First seen:2020-11-18 12:51:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:aM3+tzmlRu1wKV5Uogu/bt8LFUcc6+qHfRDQmL30q0d5mgrqatOsirnw+3K1Ykbm:a2+tzXvz/x8J+q/NL301XqatOsirnJ
TLSH 3075F5BC361175DEC96BCC76CAA82C64EE60247B930BD607A01705EDAA0DA97CF145F3
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.gredty.tk
Sending IP: 23.254.247.5
From: accountdept@mweb.co.za
Reply-To: don4eyo@gmail.com
Subject: PROOF OF PAYMENT
Attachment: PROOF OF PAYMENT.IMG (contains "PROOF OF PAYMENT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.27540.11326.18176.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c4656ba0f3dcd7ceed54c6da324ea9b783f8f5f5e9306ea5be9b38e2deb23e6/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 10:23:56 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=trdfnoqphxgxz3wvjrw2gjhktn4d7d27l2jqn2s35gzy4lplepta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 9c4656ba0f3dcd7ceed54c6da324ea9b783f8f5f5e9306ea5be9b38e2deb23e6

(this sample)

Formbook

Executable exe 543297a97a78b4347302bded28c19777fc5a7771f5c20b8042cbac3e0baadfec

  
Dropping
MD5 88c352fb8afc0d8bc3cad4133ffcc8e1
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 543297a97a78b4347302bded28c19777fc5a7771f5c20b8042cbac3e0baadfec

Comments