MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6
SHA3-384 hash: d96e7fe3fb53f1f57602b9c71cc3afa2e98ffb5dbc295e5d49ee22b53c99e2ca9c76a22f77979ccf918f1d0c3157b33a
SHA1 hash: b0f2f9c5a5d463118e27751acba702d16850f8c5
MD5 hash: 71855311af9db1549bd4f9a580196a57
humanhash: arizona-helium-jig-november
File name:PO#A91641-MSKU9953077.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-10-04 06:40:24 UTC
Last seen:2021-10-04 06:43:47 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:vbhdbMroO/lGquzY2ZmmjrmQGnHpnP6aupTzqfU0IgDKTTVz6TRvdqs0QC+VkTfW:zbMrQHzY2ZDgR6aKiIgDQVyYAkTfg
TLSH T1994512A677AF432DDCA983F5101026B2437AA5452125D67C3E9D70EC3F233B81EB069B
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?UmFkZWsgxIxlcnZpbmth?= <radek.cervinka@m-technology.cz>" (likely spoofed)
Received: "from m-technology.cz (unknown [185.222.58.155]) "
Date: "2 Oct 2021 06:58:45 +0200"
Subject: "10+2 for PO#a91641,a91642"
Attachment: "PO#A91641-MSKU9953077.IMG"

Intelligence

File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2576.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1068-1.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615c2fc798a6280f39325022/reports/fab91d6e-32af-477c-858f-e83ffe988b6e/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 04:19:36 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjwx6hdygep6fykjaqv37243cr4b32ph37j3zmphr3cub7rrnlla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img b26d7f1c78311fe2e149042bbfeb9b14781de9e7dfd3bcb1e78ec540fe316ad6

(this sample)

Formbook

Executable exe e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e777d588f24e21fdcc3add6de5b93d5fb498b594a59f03d02b5a7880bc5d5180
  
Dropping
Formbook

Comments