MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2
SHA3-384 hash: 0f8a6b88159ecb94ec38583e9e6e2a5342b49d4ba414d939dafb009a361b0e9b5f433871ac260f5e3f13f11a2395d462
SHA1 hash: e5455cc22ab413e13826bab9a49f94c5578a5f02
MD5 hash: 9157121f20211d7bc13682246b2e6c63
humanhash: crazy-missouri-autumn-bravo
File name:invoice.jpg.scr.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-05 18:39:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:fRZ+IoG/n9IQxW3OBseyKOBibZ6Tl2NJg0r:32G/nvxW3W3OB0ZU2NJ/r
TLSH 88454982E68044B0EC655F3124376D39107BBF747E78AA5EAABCB0355BB35C25232E17
Reporter abuse_ch
Tags:FormBook img Yahoo


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic313-36.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.185.59
From: Laura Tarrou <lauratarrou72@yahoo.com>
Subject: Fw: Re: Remittance
Attachment: invoice.jpg.scr.img (contains "invoice.jpg.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2/
Threat name:
Win32.Backdoor.Bladabhindi
Create hunting rule
Status:
Malicious
First seen:
2021-02-05 18:40:09 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=p6y5jnkwrot7qijpfa5lkt4h57zogvd7tieulywvpuvirzyvkcza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 7fb1d4b5568ba7f8212f283ab54f87eff2e3547f9a0945e2d57d2a88e71550b2

(this sample)

Formbook

Executable exe cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e

  
Dropping
MD5 38f952ffa3caf6aa34e98a27d553a5b3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cadecd2b0afe54440902778df16f96d7b1b8b7bedd17b8c76a961d17a3a45b0e

Comments