MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a
SHA3-384 hash: cfa4e157ff36fc1a34859d6b74968feb70ae1f14944fb57ac267a570f99610510db11f3c569b6119b0ad1d6809645f1b
SHA1 hash: 60298ff1a7c0a752b514e529fc75911a8d72bc59
MD5 hash: 5e5e9d9c078d1026899ef8f4dc41ec5f
humanhash: fruit-low-indigo-golf
File name:transferir copia_03_05.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:905'216 bytes
First seen:2021-03-06 06:49:59 UTC
Last seen:2021-03-13 12:17:10 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:pJsDH3/QE3caJQmTd7+k9x4ewzkpvbebQ27NnhJ+PBR:o3/l3/jTEk9e3kpi+R
TLSH 7215D120FF96B535E06A6AF5B980F0E245EEBD13F71E831D24D732CA077DA62A4D0215
Reporter abuse_ch
Tags:ESP FormBook geo iso Santander


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.venex.com.ar
Sending IP: 108.175.14.66
From: Banco Santander <santander@venex.com.ar>
Subject: Copia de transferencia de pago
Attachment: transferir copia_03_05.iso (contains "transferir copia_03_05.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45841301.10799.1852.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 22:19:21 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y6sjkueldvldolpyjqwk2rfztns5wnqmbqy5icp6ctmr5lhza4va._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a

(this sample)

Formbook

Executable exe 3488d309b21afbc3b481320bcf1209908813e2eb8a63df772f740426034b9958

  
Dropping
MD5 4f1a54809ac8e534239bade40b46bfab
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3488d309b21afbc3b481320bcf1209908813e2eb8a63df772f740426034b9958

Comments