MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02
SHA3-384 hash: 21d99001d1e2467cda7c4a4f517cfe6d447e72f333a5e5aae5f95b5fe2a92c11b98cf7ecdb0d3057d7df8fc4c21186d7
SHA1 hash: d57089aaa6f0a07d0be2b6a26176602b6cf1d55f
MD5 hash: c624ab007b8dc7111ca4ded4ac0aa536
humanhash: stairway-hotel-oranges-georgia
File name:Receipt_007876.pdf.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:1'101'824 bytes
First seen:2021-03-16 10:21:55 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:NxfouKlSESIdRBG9+93je32cCa/AC5lDd+/Dcl7+CRS8zdzd1:NCaIdRBjdsAC5ZdAm7Nlt
TLSH 97357B21F654AB70F03973754432033183FEAD069626E6BD7D4871DA4A76AC182F3EB2
Reporter abuse_ch
Tags:DHL FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.steelpipeskzn.com
Sending IP: 89.45.4.134
From: DHL EXPRESS INC <srp@rolberman.pw>
Subject: Delayed DHL Shipment Reciept
Attachment: Receipt_007876.pdf.iso (contains "Receipt_007876.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts64.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 08:54:28 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iu4bk4ca3wpmrfldqkcdfemarqslgra7jlnu3nvvxhoacxgadqba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 4538157040dd9ec8956382843291808c24b3441f4adb4db6b5b9dc015cc01c02

(this sample)

Formbook

Executable exe 703170d16b28086934737a474038f62654f595f1f5b30b0115806187022d1df6

  
Dropping
MD5 1f88d865877a56698964e7b6aec10944
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 703170d16b28086934737a474038f62654f595f1f5b30b0115806187022d1df6

Comments