MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 162d923b6ac3fd131e73ae485c857a31b1088da9c720c3a6f8963b68df42bbb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 162d923b6ac3fd131e73ae485c857a31b1088da9c720c3a6f8963b68df42bbb4
SHA3-384 hash: 99d41c8b29af041ea0c953d8f7512e49dc99e8bbdf403e267bce42f2c90403b93870ec2b6904e10b0fa8ecc1a1ac7a8c
SHA1 hash: 794bddbf8e229df992cbfe2a312896591e263edd
MD5 hash: a670e60b76ddfdffdbd1de0ed88b964c
humanhash: stream-bluebird-carbon-pip
File name:payment copy.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:1'085'440 bytes
First seen:2020-04-02 04:26:19 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:CHa+VByEgYiWLAuAoiC28oV6swMNx67o3mOONFqzGEcyEgYiWLAuAoiC28oV6sw+:5yDA/Y9tswMNjJleDA/Y9tswMNd
TLSH 7435E05463AC4C79D29E03B5E06A01C0A7F19517A18FEB9AB80939F95F4F7E2E8431C7
Reporter abuse_ch
Tags:COVID-19 FormBook iso


Avatar
abuse_ch
COVID-19 themed malspam distributing FormBook:

HELO: raisechem.com
Sending IP: 155.94.211.4
From: sales@raisechem.com
Subject: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment copy.iso (contains "payment copy.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.37378.27510.19994.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 04:35:42 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cywzeo3kyp6rghttvzefzbl2ggyqrdnjy4qmhjxysy5wrx2cxo2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 162d923b6ac3fd131e73ae485c857a31b1088da9c720c3a6f8963b68df42bbb4

(this sample)

Formbook

Executable exe 5605f8e6000402125426e6f6dabd257cf299aa6b179b9ebde2db059aa19e5d12

  
Dropping
MD5 ffaf8a107dacafccfc00741e97b6cca6
  
Dropping
SHA256 5605f8e6000402125426e6f6dabd257cf299aa6b179b9ebde2db059aa19e5d12
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5605f8e6000402125426e6f6dabd257cf299aa6b179b9ebde2db059aa19e5d12

Comments