MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31c8710d82bfa42d6ffd45772e60a1b379a11e93b564281c4d75add0361dfb52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31c8710d82bfa42d6ffd45772e60a1b379a11e93b564281c4d75add0361dfb52
SHA3-384 hash: 775b33e9a47a025cb10a1343aab761157d4bb3ff5f39c7b7792a3bace43c8e0c2e08d7735b9659b6cda20daabcd5589a
SHA1 hash: ef1054189782d42951d0c5962e3ed557680c0578
MD5 hash: 712016278b7ca2ca1ca1f59589dbeec9
humanhash: delaware-yankee-pizza-sink
File name:Ordine -159.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-26 06:42:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:VgJh9X0GU4yJzJxNXWUeIaJI0c7mUtVCFhp:20Fr9nSJc79tW
TLSH B6451211738088BBC6E216308EB97B2DEF79E500026A560BFF6C5B547B114A25F1F797
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ded.grow-shop-italia.com
Sending IP: 213.133.110.168
From: Simona Tramelli <finanziata@larisorsaumana.it>
Subject: R: Ordine/ Fattura
Attachment: Ordine -159.IMG (contains "Ordine -159-pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31c8710d82bfa42d6ffd45772e60a1b379a11e93b564281c4d75add0361dfb52/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 06:43:07 UTC
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghehcdmcx6sc2375iv3s4yfbwn42chutwvscqhcnoww5anq57nja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 31c8710d82bfa42d6ffd45772e60a1b379a11e93b564281c4d75add0361dfb52

(this sample)

Formbook

Executable exe 61b36d9d2e055b9e7be872cd42f44e78e9abfd505e5bc4e719d5b9801200d99e

  
Dropping
MD5 77ef1adb73a2c4bf01fa2c3521b5df8e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61b36d9d2e055b9e7be872cd42f44e78e9abfd505e5bc4e719d5b9801200d99e

Comments