MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cb0d180932053d77d02b0c78eb19051cf792b8a3ab71ea5f9bbd5d276efe76b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cb0d180932053d77d02b0c78eb19051cf792b8a3ab71ea5f9bbd5d276efe76b
SHA3-384 hash: fde62da2e5b545c83e100413f58428d0ab117651cec8d5b73256a9828b5b9bcb68df6e5a3d02de47f4668e48199cebf6
SHA1 hash: a69374f421b1ce8962329d559f271f457f2db957
MD5 hash: 663bbc80bfdd87a06c6f7acca2c9d806
humanhash: vegan-winner-carolina-friend
File name:Document.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-26 14:11:19 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:KVIHTKyfQWoiVcy5iqEQC4V5dHDwsaPWNN2gdG96x9hupaO6S:DHRfQni2yHEQC4RHDMWWes6S
TLSH 4A45C011B9D0D031D16301BA81E4E7B24ABDBD326F529A9AB7DD1F4D1BB85C26730B23
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: rdns0.greapr.xyz
Sending IP: 143.110.148.94
From: Se hee kim<office@greapr.xyz>
Reply-To: <friding7@gmail.com>
Subject: RE: RE: PAYMENT
Attachment: Document.ISO (contains "PI41006.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis1E5FE4783589.29497.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cb0d180932053d77d02b0c78eb19051cf792b8a3ab71ea5f9bbd5d276efe76b/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 02:55:26 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hsyndaetebj5o7icwddy5mmqkhhxsk4khk3r5jpzxpk5e5xp45vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 3cb0d180932053d77d02b0c78eb19051cf792b8a3ab71ea5f9bbd5d276efe76b

(this sample)

Formbook

Executable exe 81c1d78fd9c2c4e78b74976875c7ea0ac39ab5c87f5d1671e203c8c05bce01ca

  
Dropping
MD5 1e5fe47835896ae4bb10a382167cf0f1
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81c1d78fd9c2c4e78b74976875c7ea0ac39ab5c87f5d1671e203c8c05bce01ca

Comments