MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04b86943509c9523445e273bd52f76d234f72bf613d6d42ac6a3188a4186b936. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04b86943509c9523445e273bd52f76d234f72bf613d6d42ac6a3188a4186b936
SHA3-384 hash: 763e4dc36411c458a620e62e44f3a85105d5aec7c276728b5ca5a10e25e9c80c341f5543141f5b307b50818ca447de26
SHA1 hash: bea6b8b0623f5df975f99205cb002c4f0e91a960
MD5 hash: d908326d859e06f2762ee5ff1e5593d4
humanhash: vermont-hamper-charlie-salami
File name:PO AGV02-092023.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-20 08:22:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:xK44SMAFvT587wY6O02JrH5HckBw0/+/o:xK3S/e7wYt02JNcI0/o
TLSH AA45D0227AD0C870E490053CAD95A761967E7DBB3D759103BBAC120FBB602C1725F7EA
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: rdns0.hyterm.xyz
Sending IP: 134.209.44.46
From: Husain Shabbir<office@hyterm.xyz>
Subject: RE:RE:HASHTRON INTERNATIONAL TRADING RFQ DEC.Q4.
Attachment: PO AGV02-092023.ISO (contains "SKA201019.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.39726.31946.14169.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04b86943509c9523445e273bd52f76d234f72bf613d6d42ac6a3188a4186b936/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 04:12:46 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=as4gsq2qtsksgrc6e455kl3w2i2pok7wcplnikwgummiuqmgxe3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/04b86943509c9523445e273bd52f76d234f72bf613d6d42ac6a3188a4186b936

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 04b86943509c9523445e273bd52f76d234f72bf613d6d42ac6a3188a4186b936

(this sample)

Formbook

Executable exe a0c73c5e7d039898c297b3e6d1c48bc7c32eae93a24b731a0c21717925dba028

  
Dropping
MD5 23a2c71d7da1c4d0dd5aba91900cade2
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a0c73c5e7d039898c297b3e6d1c48bc7c32eae93a24b731a0c21717925dba028

Comments