MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519
SHA3-384 hash: 4f12a23a0ff1d99c15ab51f0d7acd73d019b020eb3bdbc32a8f29db54e889b9e335fc75e1799396cfc196c5470e46089
SHA1 hash: 0d818f49fd32a01ea337024e3770df4f39ad098e
MD5 hash: 3230248e026f581fd691645b7f58db4f
humanhash: december-colorado-blue-batman
File name:Bista_094924,ppdf.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:292'864 bytes
First seen:2021-03-30 12:17:54 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 3072:UTs3BxJNmJkKawnK4lc9Xhz6HwHRWNBxmV6v7jDIo6JSoMVNnJs18grng/wWopKk:UAPYKNuQ4N7mGjEaoIutWopx26
TLSH C554125D52E05477C96E08B200F2DA24F13FF34923754A4BBB1D2BBD3F572AA1929358
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: reza@bistamekan.se
Subject: Invoice Payment Schedule
Attachment: Bista_094924,ppdf.iso (contains "Bista_094924,ppdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Generic-9848208-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 12:18:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aabfsehs5ge6s5o3xj6ile43z7yw2k5dm4m6tg6afqwgymodkumq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519

(this sample)

Formbook

Executable exe 3c5cf190ba17e8138feadf46a81dbdafff69ecd8b9122aaf4967fbd9aa79c1f6

  
Dropping
MD5 7afe140cbd5211e606db688742674627
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c5cf190ba17e8138feadf46a81dbdafff69ecd8b9122aaf4967fbd9aa79c1f6

Comments