MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d
SHA3-384 hash: c920a9369ffdf0593ae6edc4e88f9f48aeaf09340f71b32e9c92a1ddc39bbe784da7dbc3b1541d99527fa3ff5c93f96b
SHA1 hash: 2679b23da8736a9402032c168bc98b9b3f5798e2
MD5 hash: 545818a2b2de1cbbde16b930d4e66294
humanhash: happy-pennsylvania-green-mango
File name:Purchase Order 33454.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2022-05-18 07:25:51 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:cYa6P1t8RTn9Bcq8hzQMHZ+mx2Jt9qZ8U8m:cYGRhB28MH3x2J+Z8bm
TLSH T1FE55D04092C0C56BD4864E74CB32D7F12B76ED222195461B33EC7E2F7B36A609D0E79A
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email (T1566.001)
From: "Procurement<sales@chinahuahe.com>" (likely spoofed)
Received: "from [140.228.29.24] (unknown [140.228.29.24]) "
Date: "17 May 2022 22:30:05 -0700"
Subject: "Green-Chinahuahe Purchase Order 33454"
Attachment: "Purchase Order 33454.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2232.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Gen.Variant.Nemesis.1805.16810.367.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62849f8f6b2a366ce41b1280/reports/2f5bceaf-6de9-48c1-ac07-face42ed2e57/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2022-05-18 05:45:47 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lviqg72lsbf3s3og5j7lmhzpc6iajgu6lqrhbsa7pnxbi5dyxuwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 5d51037f4b904bb96dc6ea7eb61f2f1790049a9e5c2270c81f7b6e147478bd2d

(this sample)

Formbook

Executable exe 2ed7589617058dc1ce78716a8ca4364ff2507862d464b46c226c8f7535d6a7f4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ed7589617058dc1ce78716a8ca4364ff2507862d464b46c226c8f7535d6a7f4
  
Dropping
MD5 086fc5469b787092cfb94b69a0e09722

Comments