MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e32c3b5bec278bba2b1a5b524cc663253c53941c82105e973606cda9b172436f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e32c3b5bec278bba2b1a5b524cc663253c53941c82105e973606cda9b172436f
SHA3-384 hash: b8608fa73b47918eaaa9d4b50d18512be8f4afdea225f34a93898070d537b18db928341ce0ed8e4b138f566043d33353
SHA1 hash: d63b736387d93f55152acad637bc060f4c807751
MD5 hash: 44245215faceff032d08cfd39a854b60
humanhash: golf-white-romeo-robin
File name:new invoice.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2022-09-23 09:11:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:3H62K21fT+sJ1SqgwB9PlIeibjgBmZX6i9fSQ/f1re7l90gm8z0c:3a231a61IwbeQSXz6Q/dglqg0
TLSH T1A345F2193AAACA12C1AC56B6D5E2452043B16943F332CB9B36CD13E50B037EE9D9D7C7
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "John <info@unihomedesigns.com>" (likely spoofed)
Received: "from pldpukeb.koreapath.com (pldpukeb.koreapath.com [85.217.145.236]) "
Date: "Tue, 13 Sep 2022 02:34:16 -0700"
Subject: "NEW ISCE ORDER"
Attachment: "new invoice.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
287
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Barys.324380.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/632d78ab12db32f02469e5ed/reports/8ee1bb23-c749-4639-9d3a-96f42eb75be7/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e32c3b5bec278bba2b1a5b524cc663253c53941c82105e973606cda9b172436f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-09-13 10:30:11 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mwdww7me6f3uky2lnjezrtdeu6fhfa4qiif5fzwa3g2tmlsinxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/e32c3b5bec278bba2b1a5b524cc663253c53941c82105e973606cda9b172436f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img e32c3b5bec278bba2b1a5b524cc663253c53941c82105e973606cda9b172436f

(this sample)

Formbook

Executable exe 04ebda83a9530337b79f15e31315d1229cf4e74e5fee4d1347ed12d7b1126ebd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04ebda83a9530337b79f15e31315d1229cf4e74e5fee4d1347ed12d7b1126ebd
  
Dropping
Formbook

Comments