MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281
SHA3-384 hash: 1e8a04d30fe24676b93cf83d519a53a1c7d91f99b0f2814c91a7eca541e4fe87a40493f5fea6ea2305f93ee2c6f7f2f3
SHA1 hash: 9d19dc4defaea9de68d9f43e61b0cefefd113a48
MD5 hash: cf8973d403a8e2b5454ade61ed9bd4e2
humanhash: rugby-wolfram-papa-michigan
File name:Betaling_advies.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:268'288 bytes
First seen:2021-04-08 08:48:00 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 3072:oyewmN4skJ6n/lSJv7/Tz7+BuFMDnbz1WmD0L1LAtdVRp6ARGYqbQ644JHmGkxe3:odD/oJTzbebz1z4LOHfprkbJIeqpG
TLSH 1944010226D19C23EE928AB44EAF673EA73797203231558BB7CC5E7B1F67781C609345
Reporter abuse_ch
Tags:FormBook geo iso NLD


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosting4.kmtiendas.com
Sending IP: 37.152.93.84
From: Marko Gasic 2CL <info@dehonbv.nl>
Subject: Betaling advies
Attachment: Betaling_advies.iso (contains "Betaling_advies.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Agent-BGTI.12610.7169.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281/
Threat name:
Win32.PUA.Wacapew
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 08:48:08 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o7qmnipdthy4nsu67d7brr6zvwzjs3mxtsv4nc27xveoc7angkaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281

(this sample)

Formbook

Executable exe 96bd9ed85e93c31a337a92e99fd6e1966f68f1a28fef43a21da725c36405988c

  
Dropping
MD5 5011945cdee260fb8688b06568d007b3
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 96bd9ed85e93c31a337a92e99fd6e1966f68f1a28fef43a21da725c36405988c

Comments