MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f99b800747424f49174b0150e3ce85146bb944fb1c8ec899a400ee889e41a4fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f99b800747424f49174b0150e3ce85146bb944fb1c8ec899a400ee889e41a4fa
SHA3-384 hash: cb0653a3b402e8242fb690a60dde4261017ed82996be48c08774d0641c174ee5c6633d9ad50e418226d7fcea6390d7a2
SHA1 hash: 26a681f5838f9acb770aa98aee977b8b683a4763
MD5 hash: fac083031c0bf4386e86389566e83c5c
humanhash: undress-pluto-pennsylvania-fifteen
File name:HSBC payment transfer 14-08-202210.50.pdf.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2022-08-17 07:57:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:RO/IIxu4xXsSAM/r2+9AmUNvvZlyb5tiQ3M2TgAFmki9bF33:RO/nLBjzcmUZvHq71gSk3
TLSH T1CA45E09F2ECC4205CC364B74ECAC11846BF2BDA53612D6DE3C9B319ACA7139C8758E56
TrID 99.6% (.NULL) null bytes (2048000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter cocaman
Tags:FormBook HSBC img payment


Avatar
cocaman
Malicious email (T1566.001)
From: "Hassan Ahmed <hassan@maqadhe.com>" (likely spoofed)
Received: "from maqadhe.com (unknown [45.137.22.93]) "
Date: "15 Aug 2022 07:35:12 +0200"
Subject: "RE: RE: HSBC payment transfer Scan copy 14-08-202210.50"
Attachment: "HSBC payment transfer 14-08-202210.50.pdf.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.1449.24672.25312.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit packed
Link:
https://www.filescan.io/uploads/62fca00f8adad7d7739a241f/reports/b057cec6-c83e-411e-96fc-39ef92a27174/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f99b800747424f49174b0150e3ce85146bb944fb1c8ec899a400ee889e41a4fa/
Threat name:
ByteCode-MSIL.Trojan.Tisifi
Create hunting rule
Status:
Malicious
First seen:
2022-08-15 17:29:11 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7gnyab2hijhusf2lafiohtufcrv3srh3dshmrgneadxirhsbut5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/f99b800747424f49174b0150e3ce85146bb944fb1c8ec899a400ee889e41a4fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img f99b800747424f49174b0150e3ce85146bb944fb1c8ec899a400ee889e41a4fa

(this sample)

Formbook

Executable exe 0d4a3632247cb7111743166b1eea26ef50d6ba2c67c3658ec4d7d8dfcdf00081

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d4a3632247cb7111743166b1eea26ef50d6ba2c67c3658ec4d7d8dfcdf00081
  
Dropping
Formbook

Comments