MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b5ed34df8d160be491c50eaa43c6ae2bf6730e2ca3eb4062265fcaff7effe5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45b5ed34df8d160be491c50eaa43c6ae2bf6730e2ca3eb4062265fcaff7effe5
SHA3-384 hash: 8080b8becc08956876563f8b3463ccb9152c69a68857ddac2e3942b5b48728762bfe091f275a8af7729a45a52a08aff5
SHA1 hash: 302f44fa1f5ddbeabc9d7b101576eff670d8f979
MD5 hash: 05afb806b7260933a04bc99a219b83c0
humanhash: iowa-enemy-mars-florida
File name:transferir copia_260322.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:638'976 bytes
First seen:2021-02-27 06:41:27 UTC
Last seen:2021-03-01 07:37:58 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:+w/sw0Lx47x8Mv3qF7bxUFaxvy1IV3aqiZaX2nqdm3nJuZGRN8ijPGAX:oXy1I5aqfF4nJz/8uG
TLSH 34D4AD352254AF10F73D8B7BC4A01554A3FAAC029762C6BF7CE835ED5BA2FB14221647
Reporter abuse_ch
Tags:ESP FormBook geo iso Santander


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cp7.blackcoralgroup.net
Sending IP: 207.58.168.245
From: Banco Santander <transferencias@agroverdedeleste.com>
Subject: Copia de transferencia de pago
Attachment: transferir copia_260322.iso (contains "transferir copia_260322.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18976.3042.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45b5ed34df8d160be491c50eaa43c6ae2bf6730e2ca3eb4062265fcaff7effe5/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-02-27 06:42:07 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iw262ng7rulaxzeryuhkuq6gvyv7m4yofsr6wqdcezp4v73677sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/45b5ed34df8d160be491c50eaa43c6ae2bf6730e2ca3eb4062265fcaff7effe5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 45b5ed34df8d160be491c50eaa43c6ae2bf6730e2ca3eb4062265fcaff7effe5

(this sample)

Formbook

Executable exe 4f9d888b7f4cd006f6611a1abf4eec8d49f3c6153c98ae662d2b39b0064f37d4

  
Dropping
MD5 c23877e1ee2ae3c82bbcd41b7d95ec58
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4f9d888b7f4cd006f6611a1abf4eec8d49f3c6153c98ae662d2b39b0064f37d4

Comments