MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4214746b270a0977713db72a74973ffec1225062ff246612e6965331ffcb48a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4214746b270a0977713db72a74973ffec1225062ff246612e6965331ffcb48a
SHA3-384 hash: 01dd6e094970e85dc9e6d7bc31deba4c842e4c6f1a9d47e05958e75ac79fe50f5c51d10f93a5333042008195d0892d4e
SHA1 hash: dd2738a17072924642e8bfc3bc7e9418d57b0dfb
MD5 hash: 4ec31b823d5070d6cea68d7e7ef16e13
humanhash: carolina-pip-coffee-social
File name:COPIA DE PAGO HSBC 2022-15-08.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2022-08-17 09:04:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:9rcRFmki9bFQg/2uh5Lg1CeBmlxFRKIwhNFoWWqaq0USLavc1hKc/7smpLufI:5wkQgBdg5Bmlx1YNoq0UwaUhN7sPA
TLSH T12055CE9F6E9E8802CD350731ECD9118467F27E967602C6CF39AB3186D2723DD4698F86
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook HSBC img


Avatar
cocaman
Malicious email (T1566.001)
From: "Yolanda Navarro <ynavarro@grupoguia.mx>" (likely spoofed)
Received: "from hwsrv-993388.hostwindsdns.com (hwsrv-993388.hostwindsdns.com [104.168.159.247]) "
Date: "15 Aug 2022 18:02:21 +0200"
Subject: "RV: PAGO JULIO JESUS EMMANUEL CONVERSION CARTA OFERTA"
Attachment: "COPIA DE PAGO HSBC 2022-15-08.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.40389.20725.20438.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit formbook packed
Link:
https://www.filescan.io/uploads/62fcaf888d742debe59c1a7b/reports/ceb324b4-6e9b-48a2-9564-55103512abbb/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4214746b270a0977713db72a74973ffec1225062ff246612e6965331ffcb48a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-08-16 10:31:35 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qquorvsocqjo5yt3nzkoslt77wbejigf7zemyjonfstgh74wsfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/f4214746b270a0977713db72a74973ffec1225062ff246612e6965331ffcb48a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img f4214746b270a0977713db72a74973ffec1225062ff246612e6965331ffcb48a

(this sample)

Formbook

Executable exe 026b1bb30922adb4dd69cef48762fd5595a4ad728ed063b1a7b595564d7fc759

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 026b1bb30922adb4dd69cef48762fd5595a4ad728ed063b1a7b595564d7fc759
  
Dropping
Formbook

Comments