MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bfcf801d5f7ae9fdfda48f17dad885c015cabc63de5546b72750842a3a283ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bfcf801d5f7ae9fdfda48f17dad885c015cabc63de5546b72750842a3a283ab
SHA3-384 hash: 0085539ef7bf1fe7710cbce0b3ee4395a3554742611789cbf04cc9ec42c19ca979c49a7a8dff77a182f84489eaf97855
SHA1 hash: 64ebc8fd9c3abb52f7962f6524bc8f4a2bb4ace1
MD5 hash: a538da2a031a5558dc228e36397e9ae5
humanhash: eleven-red-sweet-indigo
File name:KYC DEBIT FORM.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-11-19 06:47:00 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:xygukyx011HdFvE+7OhM3X2bhelzSSJ08YsoGxA64Soz8rbusT:m2HdFvE+78oX2N2doGjozybu
TLSH FA452388E39CC92DE29C3AB6E061024817E6F19F6131CF48FE8C94BF1757B5A5A15DB0
Reporter cocaman
Tags:FormBook iso


Avatar
cocaman
Malicious email (T1566.001)
From: "KYC | Compliance <maria.mt@coac.net>" (likely spoofed)
Received: "from coac.net (unknown [37.49.225.168]) "
Date: "19 Nov 2020 00:24:18 +0100"
Subject: "NEW KYC DOCUMENTATION REQUEST 2020"
Attachment: "KYC DEBIT FORM.ISO"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_doc.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bfcf801d5f7ae9fdfda48f17dad885c015cabc63de5546b72750842a3a283ab/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 05:28:42 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fp6pqaov66xj7x62jdyx3lmilqavzk6ghxsvi23soueefi5cqovq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 2bfcf801d5f7ae9fdfda48f17dad885c015cabc63de5546b72750842a3a283ab

(this sample)

Formbook

Executable exe 771dabe6b8193e58aacc414d861dfa2d229906f7a414e64feea3466b49adebea

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 771dabe6b8193e58aacc414d861dfa2d229906f7a414e64feea3466b49adebea

Comments