MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 003d7808736a60060b64d4fb0f36f951525a70a79b7d462a599425f21f300f3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 003d7808736a60060b64d4fb0f36f951525a70a79b7d462a599425f21f300f3e
SHA3-384 hash: 0f02650d357c03daff1386083dbc2b5a30b09e92ec336d4cea3b41578e06ffd7eca86277a196162f060c0bb8c7ef92b4
SHA1 hash: 997f7872082248b145324eb9e3003a2d8d424f98
MD5 hash: 7bdf78d6d92730d3197aa1059ac01a9c
humanhash: delta-speaker-golf-alpha
File name:157780.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'638'400 bytes
First seen:2020-08-13 09:22:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:TYsqYxoqzE/eLREr2/PcR8xt0Kk1Y3t6XctpI:kfiEr2caxt0KP3tAcM
TLSH 1D75072E9D2C5BA5E5165CF1DCDD9E3C4C676CC930028605E168FD98FFE378B92A201A
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dedivps-57824.dedicloud.co.uk
Sending IP: 149.255.56.120
From: Sheyda Razizadeh (Ms.) <n.akramian@atlas-group.co>
Subject: Revised PI for Level Gauge, 9770024
Attachment: 157780.IMG (contains "157780.pdf .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.30913.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/003d7808736a60060b64d4fb0f36f951525a70a79b7d462a599425f21f300f3e/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 09:24:08 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aa6xqcdtnjqamc3e2t5q6nxzkfjfu4fhtn6umkszsqs7ehzqb47a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/003d7808736a60060b64d4fb0f36f951525a70a79b7d462a599425f21f300f3e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 003d7808736a60060b64d4fb0f36f951525a70a79b7d462a599425f21f300f3e

(this sample)

Formbook

Executable exe 0f73e9d58b85ae9061722f0720ab2f76f9884042b9ac260e5c102564d4572004

  
Dropping
MD5 75b9543d2e8d5fe53cbdb649db316a03
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0f73e9d58b85ae9061722f0720ab2f76f9884042b9ac260e5c102564d4572004

Comments