MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d20fe108e1de4f53a12f8d4df552ee64513d9322256d649897ae59fef2a03ef4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d20fe108e1de4f53a12f8d4df552ee64513d9322256d649897ae59fef2a03ef4
SHA3-384 hash: 0fcb1065a083e1b105b81a885e0285f6ce3bae1ca4a57c732ce86351f9836e3dd22dbc938f904e5b484f5b2706086194
SHA1 hash: f7b1dacdd6767eecd8f8d20b0dd961adc3ac1f15
MD5 hash: 7b1e85f5e528735a03fa5fc8fa340d6e
humanhash: blossom-india-jersey-apart
File name:ONPO.CO.,LTD New Order 347389.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'507'328 bytes
First seen:2022-09-23 06:59:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Dx1qplIwokvnmi2QQZ08kcjBbRtHiApgjWe4dO0rwI0llMpI/fo/:DSplr/nmRQj8k0BbfhFLJpI/e
TLSH T10F651B0725C509A4C17250BC68CCC5B74B6A9E54E63BC546BFCDBDAFF1B2F2846D22A0
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "export@onpo.com.tr" (likely spoofed)
Received: "from [109.206.241.117] (unknown [109.206.241.117]) "
Date: "12 Sep 2022 15:06:24 +0200"
Subject: "RE:ONPO.CO.,LTD New Order 347389"
Attachment: "ONPO.CO.,LTD New Order 347389.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2229.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Inject4.42577.UNOFFICIAL
Create hunting rule

Win.Dropper.Nanocore-9969263-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/632d59b636ba812561b0db1d/reports/9591591d-2ff0-4023-8f15-fce4224e191b/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d20fe108e1de4f53a12f8d4df552ee64513d9322256d649897ae59fef2a03ef4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-12 06:39:48 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ih6cchb3zhvhijprvg7kuxomrit3ezcevwwjgexvzm754vah32a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d20fe108e1de4f53a12f8d4df552ee64513d9322256d649897ae59fef2a03ef4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img d20fe108e1de4f53a12f8d4df552ee64513d9322256d649897ae59fef2a03ef4

(this sample)

Formbook

Executable exe 84cd1092d3d60114702dd6db25a79ac062b5f8f481413bb3e5eaf263a06016d8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84cd1092d3d60114702dd6db25a79ac062b5f8f481413bb3e5eaf263a06016d8
  
Dropping
Formbook

Comments