MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69052957503016194c8dad542e3b03a96b7ffbbe11a7cff3abd7f68bbe5e0f54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69052957503016194c8dad542e3b03a96b7ffbbe11a7cff3abd7f68bbe5e0f54
SHA3-384 hash: 9e5778d3b8916d6d6404cd37ecb194871e587f581175146c84ed0537e410d5f6b7950009babdb871de5f1308210b917f
SHA1 hash: 41b05ee89b0ccb7d2d00d491ca72983094b6cd2b
MD5 hash: 94531622d1ea002ec99654ca5fdfbcfb
humanhash: louisiana-may-tennessee-robert
File name:RFQ_OB Jiefeng EE Co Ltd.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:290'816 bytes
First seen:2021-03-02 07:47:11 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:nT4Dt+yxkNcCbuD7yTSH6MMkV1MJH6Rh8C2e+HEx:nTDyCNcCKD06Rdfcm3lxx
TLSH 5E540150E220D837E6B243325624AB774FFBD22545B49B4B738C6C593FA36C6AE0E351
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.suministroscarmelo.com
Sending IP: 146.255.103.156
From: Zhangjiagang Haifeng Elevator Guide Rail Co.,Ltd.  <jiefeng001@elevator.hk>
Subject: O/B Jiefeng E&E Co.,Ltd_ Inquiry
Attachment: RFQ_OB Jiefeng EE Co Ltd.iso (contains "RFQ_OB Jiefeng E&E Co Ltd.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Jaik.44300.30809.18188.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69052957503016194c8dad542e3b03a96b7ffbbe11a7cff3abd7f68bbe5e0f54/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-02 07:48:09 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=necssv2qgalbstenvvkc4oydvfvx7656cgt4745l273ixps6b5ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/69052957503016194c8dad542e3b03a96b7ffbbe11a7cff3abd7f68bbe5e0f54

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 69052957503016194c8dad542e3b03a96b7ffbbe11a7cff3abd7f68bbe5e0f54

(this sample)

Formbook

Executable exe 7d803e44c98cd23b971f692182f8d1d508fe82fb0fd6b681e7896c552d88411a

  
Dropping
MD5 63f46a184f61c0f7a8085b2c96415909
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7d803e44c98cd23b971f692182f8d1d508fe82fb0fd6b681e7896c552d88411a

Comments