MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42542395939cf980f3c30f3a36e1125c94787b0a1d79c7ba0918f46764a22704. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42542395939cf980f3c30f3a36e1125c94787b0a1d79c7ba0918f46764a22704
SHA3-384 hash: 0b5de12010f20f20e2e9c1c9c6fcf2739a175d78793872ebc82a1e2eb6cb2c6c5cd6d80cd58048ba37a0b528ddefdb7a
SHA1 hash: 2d020e72bb21b832626a6ce526d537858c4f2803
MD5 hash: 2d6781f8efe426d140f1c928a712fca8
humanhash: summer-nineteen-mars-island
File name:EDAS ITALIA SRL product specifications.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:638'976 bytes
First seen:2020-08-03 06:59:01 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:ETyHrexwWwfNDy0rRA1ocXB18MjkiTXHCMe:wQrMWy0rC1ondN
TLSH 22D4CF6C0BE00919F96E1B7EAC360503DF35F40B5827A39F26B914B90ABBB949D50F17
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: www1138.sakura.ne.jp
Sending IP: 219.94.129.178
From: Sales Dept <sales01@edas.it>
Subject: RE: EDAS ITALIA SRL (INQUIRY)/Product Catalogs and Price list request
Attachment: EDAS ITALIA SRL product specifications.iso (contains "qoutationw.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42542395939cf980f3c30f3a36e1125c94787b0a1d79c7ba0918f46764a22704/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 07:00:08 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ijkchfmttt4yb46db45dnyislskhq6ykdv44poqjdd2gozfce4ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/42542395939cf980f3c30f3a36e1125c94787b0a1d79c7ba0918f46764a22704

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso 42542395939cf980f3c30f3a36e1125c94787b0a1d79c7ba0918f46764a22704

(this sample)

FormBook

Executable exe d1176c3c4ab396d3bad7dd15c881fdb4e38922e9f7e539dc1035768f366edcf9

  
Dropping
MD5 5d4343bc084ffb640028ac5575c1277e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d1176c3c4ab396d3bad7dd15c881fdb4e38922e9f7e539dc1035768f366edcf9

Comments