MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9db39f7d777e809c8ae89b05e33d184c29fb4542f80749e8bfb0aacca06f2959. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9db39f7d777e809c8ae89b05e33d184c29fb4542f80749e8bfb0aacca06f2959
SHA3-384 hash: 89cd966682a0a4e7ffdf5365c0095114527eb1c99d3e3e31269321159475f83612cdcc2420b51fe317d6360157f38793
SHA1 hash: ddcd25fca93c8a6ea8bc886a8f8240d344c45a9a
MD5 hash: bae28237779327a036a410e49b49d634
humanhash: tango-lamp-minnesota-summer
File name:Payment-Advice.pdf.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'376'256 bytes
First seen:2020-08-17 14:03:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:4vL4pvx3IossdS3kQMYw9pkyFiYJtPSX7PYorluS:m0BjJkUDrkBMtaX7Pt
TLSH C35501509204892AF6F806B8A27A05147B78DDD63CF2FFA47E68B19336F7793081156F
Reporter abuse_ch
Tags:FormBook HSBC img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: h2252633.stratoserver.net
Sending IP: 85.214.202.139
From: HSBC Advicing Service <infos@hsbc.com.my>
Reply-To: citrroen.gouws@gmail.com
Subject: HSBC Payment Advice!
Attachment: Payment-Advice.pdf.img (contains "Payment-Advice.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9db39f7d777e809c8ae89b05e33d184c29fb4542f80749e8bfb0aacca06f2959/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 14:05:11 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twzz67lxp2ajzcxitmc6gpiyjqu7wrkc7adut2f7wcvmzidpffmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9db39f7d777e809c8ae89b05e33d184c29fb4542f80749e8bfb0aacca06f2959

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 9db39f7d777e809c8ae89b05e33d184c29fb4542f80749e8bfb0aacca06f2959

(this sample)

Formbook

Executable exe 68b06b7a02ddedc6cca5e2c9e2f91fe8374440ad93aa04e40a84cde5a76f8234

  
Dropping
MD5 0277c55a2a041396aa4d3ce9c35913ed
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 68b06b7a02ddedc6cca5e2c9e2f91fe8374440ad93aa04e40a84cde5a76f8234

Comments