MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4
SHA3-384 hash: 066ddcca9d15cf7c8f8e0c56561b3caa8a7089cdd14ed7ee353fbcd90eb0af3fd4a7c4495ddb13e980549e54c0814784
SHA1 hash: 0476c3983a18d650e26212b56e6fc54338e8c5ca
MD5 hash: 910629e4fdd52fddb024a200d6601685
humanhash: pasta-bulldog-sink-football
File name:RFQ_AP65425652_032421 vấn đỠ,pdf.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:458'752 bytes
First seen:2021-04-07 05:54:13 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:dDIdstvLGtELbMUTKZp3+3lb8I80AEdbCdin9j:KSityjKb+398T07MQj
TLSH 93A45C823184DCDAE04329F248AFD57061796D9E8165CA0E374BBF2B96E7343245F78E
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cloudhost-831079.us-midwest-1.nxcli.net
Sending IP: 8.29.153.156
From: Châu Kim Long <sales1@ito-group.com>
Subject: RFQ_AP65425652_032421 vấn đề
Attachment: RFQ_AP65425652_032421 vấn đỠ,pdf.iso (contains "RFQ_AP65425652_032421 vấn đỠ,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 01:12:17 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dter2jjl7axl37ptmyyb7dgsak3qrx7thg6qhuyp7xlvsw2s3lsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 1cc91d252bf82ebdfdf366301f8cd202b708dff339bd03d30ffdd7595b52dae4

(this sample)

Formbook

Executable exe bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e

  
Dropping
MD5 dbb02607b56bb87a9c1c511fb5b0b0be
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd6055810a703f4f0caec388c7cce89661ee9451179dc3abe6261480bda4105e

Comments