MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7e8866e1307e6e2d79c43d9940a379c2320c75b55326a89c878c096f440cce99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | 7e8866e1307e6e2d79c43d9940a379c2320c75b55326a89c878c096f440cce99 |
|---|---|
| SHA3-384 hash: | cb0f0adb065afbc2fd1d7e96a048eebf88cb24412d82caecc19c659da1be46b61eaee7fca7b621be1384d0471e056eb7 |
| SHA1 hash: | 944004607e4fc0cf3ae8d01885372838d2df2e98 |
| MD5 hash: | ff9e1137831cd92fc60d2a349b2777ad |
| humanhash: | london-failed-salami-king |
| File name: | payment.copy.iso |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'245'184 bytes |
| First seen: | 2022-05-17 08:29:05 UTC |
| Last seen: | Never |
| File type: | iso |
| MIME type: | application/x-iso9660-image |
| ssdeep | 3072:pfY/TU9fE9PEtuNEydTbMh19QCoWGJxdmwOovOf0VrJVJTpmecypUqEkK//rwjzN:VYa6DmDQCB8dHGf03zsSvEkBzbfWc8B |
| TLSH | T19E45F1D0E352E4D3F8534E304AB26E951FD862076137873737BDDA16AF632D0AA1A316 |
| TrID | 99.4% (.NULL) null bytes (2048000/1) 0.2% (.ISO) ISO 9660 CD image (5100/59/2) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) |
| Reporter |  cocaman |
| Tags: | FormBook iso payment |
cocaman
Malicious email (T1566.001)From: "Sarah Marchisio<sarah@cobra-cs.com>" (likely spoofed)
Received: "from cobra-cs.com (unknown [103.232.53.182]) "
Date: "16 May 2022 20:44:38 -0700"
Subject: "BANK PAYMENT CONFIRMATION"
Attachment: "payment.copy.iso"
Intelligence
File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2022-05-17 03:39:55 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
19 of 41 (46.34%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
xloader
Score:
10/10
Tags:
family:formbook family:xloader campaign:u8pg loader rat spyware stealer suricata trojan
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
Formbook
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.