MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15cdb8b57d43cf039ab3a483cdff448a91f9257e0a218fe59bd06da44927014c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15cdb8b57d43cf039ab3a483cdff448a91f9257e0a218fe59bd06da44927014c
SHA3-384 hash: 47195d7ea15e5344818f32b152d687f966c696294fa232c5ac3b5e02ea614097873954ff0d03a671d1c832884c575dc7
SHA1 hash: cad5c83c9d5c42527049ddaba734109f57d22ec0
MD5 hash: 3b207e46ffab766e73fa175e55b8e1bf
humanhash: coffee-west-king-october
File name:PO.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-16 13:02:11 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:E5ju++P86cr99uGKZP/2lRMr+8PNJdT+n:E5y7E6crzAMWbPNu
TLSH D745CF2573C5D8B5D056083900D0FAB2186CA9742F5F8A9F77CE677ECBA45C2523AA0F
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: rdns0.teleaurd.xyz
Sending IP: 198.199.75.148
From: April<office@teleaurd.xyz>
Reply-To: <jossycool1234@gmail.com>
Subject: ??:??:Request for new model ECG quotation
Attachment: PO.IMG (contains "ASQ2109942.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15cdb8b57d43cf039ab3a483cdff448a91f9257e0a218fe59bd06da44927014c/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 03:35:54 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cxg3rnl5iphqhgvtusb4372erki7sjl6biqy7zm32bw2isjhafga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
VirLock
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/15cdb8b57d43cf039ab3a483cdff448a91f9257e0a218fe59bd06da44927014c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 15cdb8b57d43cf039ab3a483cdff448a91f9257e0a218fe59bd06da44927014c

(this sample)

Formbook

Executable exe a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe

  
Dropping
MD5 693849c501a595f56ca33ce5ca0ef2a2
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a76869f6ece56a889175cb2cebdb60e4a24025184ebeb7fa9c6210668eb023fe

Comments