MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 731d6f8580e100a682f1b62200fb537bee1e65333f2a0498cb91093b14ef3bd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 731d6f8580e100a682f1b62200fb537bee1e65333f2a0498cb91093b14ef3bd5
SHA3-384 hash: fe00a35965b2494e50888fcb4c82d8e4f8b190fdf55220d7aff2c7a783f26cde1ed2873bbdb0fc3ce98fa2f4d91789f4
SHA1 hash: 1206b006b5d8686f90388908ca7915131df7d13c
MD5 hash: 7f0b0ade4f26fdfd97d32b1583bb1929
humanhash: fifteen-don-dakota-louisiana
File name:Arrival Notice.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:1'155'072 bytes
First seen:2021-01-19 07:20:20 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:DfMOJpgYUGwcHSNH5TtDegYjOUiJl5RHd:D5gYUnc0ZTteDiJlj9
TLSH 9835AD0122887F28F6BD4737D4A8541497FEEC019722DA2EBCE439DE59B2F91A617307
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: www2325.sakura.ne.jp
Sending IP: 112.78.125.165
From: KONGSUWAN Titira <THD.TKONGSUWAN0@cma-cgm.com>
Subject: ARRIVAL NOTICE : NORDLION V. 0QI7JS - THLCH // DBA0235976 ZAZBAS
Attachment: Arrival Notice.iso (contains "Arrival Notice.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.29475.16333.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/731d6f8580e100a682f1b62200fb537bee1e65333f2a0498cb91093b14ef3bd5/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 01:54:25 UTC
AV detection:
2 of 46 (4.35%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=omow7bma4eaknaxrwyrab62tppxb4zjth4vajgglseetwfhphpkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/731d6f8580e100a682f1b62200fb537bee1e65333f2a0498cb91093b14ef3bd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 731d6f8580e100a682f1b62200fb537bee1e65333f2a0498cb91093b14ef3bd5

(this sample)

Formbook

Executable exe 14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e

  
Dropping
MD5 4817f2cac71c4d47f1f478d69703db60
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14ee2894b546ba6d7835ee4dd8e07ef72fb10bfaebec8f1687da4559267cb72e

Comments