MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47a611f36e2953717b1be9ee75546a9a75cbf915f92bbd7b6db79d67cc3f3d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47a611f36e2953717b1be9ee75546a9a75cbf915f92bbd7b6db79d67cc3f3d4
SHA3-384 hash: 31240ee67ac18441fa1b4a451e89adbcba3726916dc336f0e31db92f3dc069f2505fadab3714c10f04803ec23d43277f
SHA1 hash: ef6af08c855454c18b1251b7bd5798e6be5c426d
MD5 hash: e49506061a961168119db870799b6910
humanhash: music-tennessee-lactose-harry
File name:Revised PI 8312022.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'376'256 bytes
First seen:2022-08-31 12:17:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:foL3wzefIbZ5GwuftSoNpZZrXiUYzOYUmBQVvFd5:fobwX5Gwugo9R/YzOYhBgd
TLSH T18355D00AFA66C911F2A41B33C2E592044335AF09E127D75F79CC63A95A433ABCE47787
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Summer Lin <summer@mlmfurniture.com>" (likely spoofed)
Received: "from mlmfurniture.com (unknown [45.137.22.61]) "
Date: "31 Aug 2022 12:14:20 +0200"
Subject: "Re: REVISED THE PROFORMA updated PI 8292220"
Attachment: "Revised PI 8312022.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Tedy.195528.31740.3919.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630f5186e87b88e71be798c1/reports/e35de18c-5606-43ce-83f0-6222dd95d805/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47a611f36e2953717b1be9ee75546a9a75cbf915f92bbd7b6db79d67cc3f3d4/
Threat name:
ByteCode-MSIL.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2022-08-31 12:18:09 UTC
File Type:
Binary (Archive)
Extracted files:
24
AV detection:
12 of 26 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r5gchzw4kktof5rx2poovkgvgtvzp4rl6jlxv5w3n45m7gd6pka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e47a611f36e2953717b1be9ee75546a9a75cbf915f92bbd7b6db79d67cc3f3d4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img e47a611f36e2953717b1be9ee75546a9a75cbf915f92bbd7b6db79d67cc3f3d4

(this sample)

Formbook

Executable exe afa7fb82ff2a4862bc1a047d8a6640636ec2aded44fe057ba45515a906709423

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 afa7fb82ff2a4862bc1a047d8a6640636ec2aded44fe057ba45515a906709423
  
Dropping
Formbook
  
Dropping
MD5 3da2bbc7fa49cc1214d98adbfc02b23d

Comments