MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 701d5c21eff2fd19e68b76008fed78882a22fa31821f690d3352680dec311bb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 701d5c21eff2fd19e68b76008fed78882a22fa31821f690d3352680dec311bb7
SHA3-384 hash: d43725ab8ad0624dc9142e5d2a7567b387dbf4e782fb528d02b26f2f29c55544ecef6cb65b6bc0478823d8b4c708f82f
SHA1 hash: 0a7efff49574c2cb37ec721d8c0549bb9796ece6
MD5 hash: d9197833d0052302ee3e3cb34a5b94ec
humanhash: utah-michigan-edward-lake
File name:Inquiry from United Kingdom.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:729'088 bytes
First seen:2020-10-13 05:50:18 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:RO0/6zusHcLeXptEPZ3BnLSr/ke6Gzb39VezdnCb6B4bJdlH:Rlyz0cptgxn4/kzAb3DezdnCbq+b
TLSH A6F4DF6B32E59F21E03EDBBD0A60454407F2E886F722D65E7DBD11E90793F8217A2712
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.collinsltd.ga
Sending IP: 204.13.155.158
From: Rob Hodges <info@collinsltd.ga>
Subject: Inquiry from United Kingdom
Attachment: Inquiry from United Kingdom.iso (contains "Inquiry from United Kingdom.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.445.842.8512.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/701d5c21eff2fd19e68b76008fed78882a22fa31821f690d3352680dec311bb7/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 02:14:40 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oaovyipp6l6rtzuloyai73lyravcf6rrqipwsdjtkjua33brdo3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/701d5c21eff2fd19e68b76008fed78882a22fa31821f690d3352680dec311bb7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 701d5c21eff2fd19e68b76008fed78882a22fa31821f690d3352680dec311bb7

(this sample)

Formbook

Executable exe 7475282fc3b82d0f60ccf30aba39303bc16c9a7a314382560a300dca7257d9f9

  
Dropping
MD5 385b75d2742a03b19975614017193a99
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7475282fc3b82d0f60ccf30aba39303bc16c9a7a314382560a300dca7257d9f9

Comments