MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5
SHA3-384 hash: ca7e7839c0d3d3253140efc5dd0467311cfbc69af237cb04aa261751f76dd17e2149094cfb57691b56d1922aa1ddecea
SHA1 hash: 11381206911bd08ee006cb35bc664c47e2586977
MD5 hash: 0e0f6f0e071d56bd3dac80d8ef637e8e
humanhash: video-cold-green-comet
File name:RFQ_38463846393646388368364834.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:2'686'976 bytes
First seen:2021-03-16 10:35:51 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 49152:J7myfeqqD0jjxnqkaaFZp27enk6ymYIr7GrCKnY27RENq6+7U8LcjHWdr:J7myfB3ebDgJEr
TLSH 8DC55A04F754AE96D5171B76C1A3852482E4DE6B2273F30F79D9BCE27A3238A4D4E4C2
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.softwarecommercials.com
Sending IP: 154.16.145.158
From: Krista Aranda <amarnex.mail@msa.hinet.net>
Subject: Proforma Invoice
Attachment: RFQ_38463846393646388368364834.ISO (contains "RFQ_38463846393646388368364834.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 06:33:07 UTC
AV detection:
14 of 47 (29.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4amrutoz64wwu5h63nhh2k7gr3xhayjakf6fmy4atves5iuis2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 8700c8d26ecfb96b53a7f6da73e95f3477738309028be2b31c04ea49751444b5

(this sample)

Formbook

Executable exe 999813d0bce8eb3dd4057bb0535d1ce571c272a3ac60264d4a4ecc28f7644875

  
Dropping
MD5 7f7a4249559e5ee4540994f94def85db
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 999813d0bce8eb3dd4057bb0535d1ce571c272a3ac60264d4a4ecc28f7644875

Comments