MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49d45c1f0ad63ab5b9f495c52a61b83eba97026d4a42c004e6dc63134ba333a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49d45c1f0ad63ab5b9f495c52a61b83eba97026d4a42c004e6dc63134ba333a8
SHA3-384 hash: cdedc4df2d74bcad5afb440c9ed17baf50e3e4644c2fac71daa73e8882a73718a5cba39204e9bf17511f2ae7e2b09245
SHA1 hash: f71bed5816673c1498bcd29cfbfb58c5133ecefc
MD5 hash: dc32379f915304e3b90a7e7aa38502d5
humanhash: mississippi-spaghetti-missouri-echo
File name:unnamed1.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:200'704 bytes
First seen:2022-02-18 11:05:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 1536:x+bTru7ZWEIGdTH9VX9MiHmZrFEBwtL9HhGTeYE317fWaeVTP6JU7a3S6UNciyKU:QbTru7dbBUqJFEFCF6JWaddK94V8Er
TLSH T118148D183F8F9A59E5E20B7D8BA253486323B56566331E1B723D372B9B231883ED1345
Reporter c_APT_ure
Tags:iso


Avatar
c_APT_ure
Received: from [103.145.252.202]
by jimbaes.ml with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256)
(Exim 4.90_1)
(envelope-from <sawayn@jimbaes.ml>)
id 1nKtpZ-0006na-F7; Fri, 18 Feb 2022 03:21:13 +0000
Content-Type: multipart/mixed; boundary="===============1416460656=="
MIME-Version: 1.0
Subject: Ihre Aktualisierung
To: Recipients <sawayn@jimbaes.ml>
From: sawayn@jimbaes.ml
Date: Thu, 17 Feb 2022 19:20:58 -0800
Reply-To: salamancajesus@gmx.es
Message-Id: <E1nKtpZ-0006na-F7@jimbaes.ml>


Guten Tag,

Nach einem Gespräch mit Ihnen füge ich Ihre aktualisierten Sonderwirtschaftlichen Bedingungen bei.

Ich warte darauf, dass Sie mir den Unterschied mitteilen, der bei Ihrem aktuellen Transport bestehen kann.

Einen schönen Tag noch,
Manuel Navarro
Dpto Comercial
DHL Parcel
Tfno 91 198 81 60
ventascarretera@dhl.com.


Attachments:
dc32379f915304e3b90a7e7aa38502d5 unnamed1.iso
a0812ee421b7a8b41f05499e6e73a6f8 SONDERBEDINGUNGEN FÜR AKTUALISIERTE PAKETE VON DHL, pdf.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts66.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Downloader.10124.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.PkillISOStopTheClocks.20211020.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/620f7d9da2660f3bb9faa23b/reports/28cd3e60-e0af-4208-be46-65125c8fda38/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49d45c1f0ad63ab5b9f495c52a61b83eba97026d4a42c004e6dc63134ba333a8/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 07:53:55 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
15 of 42 (35.71%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhkfyhyk2y5llopusxcsuynyh25joatnjjbmabhg3rrrgs5dgoua._file
Result
Malware family:
xloader
Create hunting rule
Score:
  10/10
Tags:
family:xloader campaign:i9ng loader rat suricata
Link:
https://tria.ge/reports/220218-m7ebqadcem/
Behaviour
Gathers network information
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Xloader Payload
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/49d45c1f0ad63ab5b9f495c52a61b83eba97026d4a42c004e6dc63134ba333a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 49d45c1f0ad63ab5b9f495c52a61b83eba97026d4a42c004e6dc63134ba333a8

(this sample)

Formbook

Executable exe f8f1b145c2a92cb79b32568f3300732e3d79bd5f157a1e54b77c1058707a972c

  
Dropping
MD5 a0812ee421b7a8b41f05499e6e73a6f8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8f1b145c2a92cb79b32568f3300732e3d79bd5f157a1e54b77c1058707a972c

Comments