MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7f416ee61342d5929c689997c727fd0f260df608d7b9d3ca185ef8258887f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7f416ee61342d5929c689997c727fd0f260df608d7b9d3ca185ef8258887f1c
SHA3-384 hash: fa23a538ed7cad4cf83d384414dc4862e90786b099982d08c7f4518b152d598eab5a92354eb01831513fd84f4e8aeaa8
SHA1 hash: d9fb3109fbcbae261ae749d651b6999caf5802ef
MD5 hash: 4ef63ff3986ac4eedb65174482a3ebe0
humanhash: skylark-hot-lion-wyoming
File name:AWB 3877940054.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2022-09-15 09:44:17 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:SzE+Lr2iNEF75euLUB/P0xeNLr3xrobrD3piFrGbNqDoXKCsHFBbPmXsXRFwS:Or16Z5fI0xGr3x8br66bQDoXjS9POeR
TLSH T1C655F10DE261AFE0F06903B92170E5266F797F1544BED59C2CEAB2E71AB4397400BD87
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:DHL FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "PS Shriram (DHL IN) <PS.Shriram@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [45.137.22.61]) "
Date: "5 Sep 2022 14:23:08 +0200"
Subject: "RE: FW: AWB: 3877940054 / Salcomp"
Attachment: "AWB 3877940054.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2579.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.1427-2.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
formbook packed remcos
Link:
https://www.filescan.io/uploads/6322f427b564f001cc8982af/reports/d80478fc-53c4-4e7b-a752-1a639b45d144/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7f416ee61342d5929c689997c727fd0f260df608d7b9d3ca185ef8258887f1c/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-09-05 11:49:40 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=472bn3tbgqwvskogrgmxy4t72dzgbx3arv5z2pfbqxxyeweip4oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/e7f416ee61342d5929c689997c727fd0f260df608d7b9d3ca185ef8258887f1c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img e7f416ee61342d5929c689997c727fd0f260df608d7b9d3ca185ef8258887f1c

(this sample)

Formbook

Executable exe 1639a76ac7f4c8944bf7f7599c15f68c5211ecab7704e18bfd66400ef7688b9b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1639a76ac7f4c8944bf7f7599c15f68c5211ecab7704e18bfd66400ef7688b9b
  
Dropping
Formbook
  
Dropping
MD5 81d542e174ecce4b80ac4c00f7f63512

Comments