MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b586ddc3520d723a7280a22dd8ad4b43cf7cdd091b69e88b0671a5ddfbe73008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b586ddc3520d723a7280a22dd8ad4b43cf7cdd091b69e88b0671a5ddfbe73008
SHA3-384 hash: 0d14f750367b17b2dc66cabb1664cabe652ee09018714ff55cc752244a5181a7da1e54d4e1c93bada11999b6b32d2ece
SHA1 hash: 7b4fa24a5e553ebd4e46aa4e199cd4c425dbf3e1
MD5 hash: d6391e6d3c9e90b96ed33d9f109bdf20
humanhash: edward-ack-lamp-comet
File name:KYC DEBIT FORM 1.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-20 08:02:53 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:fiHYRuVLX/Jp+zlQiMAi513nW3HDUnIIb1duIXOX:2Y4V9p6lx4/nsHDUnBbOIXO
TLSH 03451295B78D6B31D1AD36BF3561219883B44292D202DA5B7ECCD3FF0F547881A222F6
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: kyc.com
Sending IP: 37.49.225.168
From: KYC | Compliance <compliance@kyc.com>
Subject: NEW KYC DOCUMENTATION REQUEST 2020
Attachment: KYC DEBIT FORM 1.ISO (contains "KYC DEBIT 11202020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b586ddc3520d723a7280a22dd8ad4b43cf7cdd091b69e88b0671a5ddfbe73008/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-20 08:03:22 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwdn3q2sbvzdu4uauiw5rlkliphxzxijdnu6rcygogs5367hgaea._file
Malware family:
XLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b586ddc3520d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso b586ddc3520d723a7280a22dd8ad4b43cf7cdd091b69e88b0671a5ddfbe73008

(this sample)

Formbook

Executable exe dc124de38bc46065f427928b5b1c0dae742f8dbbca236e611735f24ae70e6cb5

  
Dropping
MD5 1a507889b51bb4c630efdab875fe492d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc124de38bc46065f427928b5b1c0dae742f8dbbca236e611735f24ae70e6cb5

Comments