MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea6d4fde8ab002c8525d94e4ad415753ac6fc8353dc0aa01c3797085e1d5aad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea6d4fde8ab002c8525d94e4ad415753ac6fc8353dc0aa01c3797085e1d5aad2
SHA3-384 hash: 0af3b69f7222a44717a36334a631243259b3bca871a9465c1921f4039b3135070fad11a0856617c400906fad48bbc6b2
SHA1 hash: 9833d7af7afc7f7c70f7d40bb3582f17dbd535d1
MD5 hash: dbc7c8fe1d529f7925623fa62524780d
humanhash: undress-nebraska-item-alaska
File name:IFETESTEY.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'441'792 bytes
First seen:2022-08-20 14:01:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:ZCxhKzCg1vDBKufvyB9hslVsFrD1DxkDQw1:dzNDguHyBTslVsf1kDQg
TLSH T12B65024077999452C1AC0F3A4522DF048670ACE7E91DEB8BBCCEF2991B7A790C451B5F
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Oder <mad.mur@koreapath.com>" (likely spoofed)
Received: "from pldpukeb.koreapath.com (pldpukeb.koreapath.com [85.217.145.236]) "
Date: "20 Aug 2022 09:54:24 +0300"
Subject: "RE: ORDER"
Attachment: "IFETESTEY.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1496.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6300e99bff96c3522074a522/reports/0e39c665-21ec-479f-b750-5945e7f8a02c/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea6d4fde8ab002c8525d94e4ad415753ac6fc8353dc0aa01c3797085e1d5aad2/
Threat name:
Win32.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-08-20 05:29:30 UTC
File Type:
Binary (Archive)
Extracted files:
14
AV detection:
17 of 39 (43.59%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5jwu7xukwabmqus5stsk2qkxkowg7sbvhxakuaodpfyilyovvlja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/ea6d4fde8ab002c8525d94e4ad415753ac6fc8353dc0aa01c3797085e1d5aad2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img ea6d4fde8ab002c8525d94e4ad415753ac6fc8353dc0aa01c3797085e1d5aad2

(this sample)

Formbook

Executable exe 78baa36f2d7dc4a5461fbe4fa0829151bb84361047d4d3cf4adad84308177afd

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 78baa36f2d7dc4a5461fbe4fa0829151bb84361047d4d3cf4adad84308177afd
  
Dropping
Formbook
  
Dropping
MD5 5c65b19c1209c454e3da03f65c50baca

Comments