MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc09ce738c58e335e037c8ab5ddb856603481dfb798ccf1853a5d4da26227eb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc09ce738c58e335e037c8ab5ddb856603481dfb798ccf1853a5d4da26227eb1
SHA3-384 hash: 628dba4eb6a096a8cd6a02065e58b895cade639787de620d534f6b86b5da6b576ba6cac503988c5ce13bdf2487e51539
SHA1 hash: 9532e81495af282207f0d921005cb8568a5ac712
MD5 hash: 1705bdfe97fd65237ae7d11d4f31cdd0
humanhash: lion-speaker-mobile-diet
File name:IMAGE-04082020.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-04 13:36:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:KR29grlqTGODDOuq7I1cXfh1aHYYZzwBUn9CwCJz5i2EEoVhv+s:KtEDOa1cXf3aHvZ0BUn3CJz5i+oVhvR
TLSH B1453A283A17CE72FDED0B7D80CB0D144FA71A05516DF64F24AD11D2B8ABB854926F8B
Reporter abuse_ch
Tags:img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: www210b.sakura.ne.jp
Sending IP: 219.94.155.70
From: Anthony <anthony@unitedllc.com>
Subject: RE: Tucker lane
Attachment: IMAGE-04082020.IMG (contains "IMAGE-04082020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.30491.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc09ce738c58e335e037c8ab5ddb856603481dfb798ccf1853a5d4da26227eb1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 13:38:09 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqe4444mldrtlybxzcvv3w4fmybuqhp3pggm6gctuxknujrcp2yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.77
Link:
https://yomi.yoroi.company/submissions/cc09ce738c58e335e037c8ab5ddb856603481dfb798ccf1853a5d4da26227eb1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img cc09ce738c58e335e037c8ab5ddb856603481dfb798ccf1853a5d4da26227eb1

(this sample)

Formbook

Executable exe 1f3a78fa36bc0741a38e82e73ea0a214ef806c0d968c70b99aa71c73864be656

  
Dropping
MD5 451347fc2142b7f84e5cf3e2bca618d8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1f3a78fa36bc0741a38e82e73ea0a214ef806c0d968c70b99aa71c73864be656

Comments