MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a15b39af6ab70fbed561712c684d0694b055d52d222f1f006a8ae984cfb6278. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a15b39af6ab70fbed561712c684d0694b055d52d222f1f006a8ae984cfb6278
SHA3-384 hash: 1eaf1c43f6fefab9a166ee0ec1d6ad70d9773743445e5cb2b3f0136b166f20ce430874e2a194beb42dc658e1da6319ed
SHA1 hash: c1b8ebc9d19fb748e75c8db19b716de4472e918c
MD5 hash: 1b769eb6deca1f13c5febd7ea5d6c7d9
humanhash: hydrogen-finch-pizza-double
File name:TT-0121.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'507'328 bytes
First seen:2021-01-21 16:42:34 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Re50jwcEc6t4YM2YsDZwdbz1LzDmV0fZQK2:408cEc6t4ADAbRfWK2
TLSH 3C656AC1A9CF89EDC0681937C15E719503D9E5A9A530B1AA3F8C6A5AC7E3DC0A1D40FF
Reporter cocaman
Tags:img


Avatar
cocaman
Malicious email (T1566.001)
From: "Account <office@cowbown.com>" (likely spoofed)
Received: "from slot0.cowbown.com (slot0.cowbown.com [203.159.80.100]) "
Date: "21 Jan 2021 09:52:53 -0500"
Subject: "PAYMENT RECEIPT"
Attachment: "TT-0121.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs2061.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a15b39af6ab70fbed561712c684d0694b055d52d222f1f006a8ae984cfb6278/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-01-21 16:43:06 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rik3hgxwvnypx3kwc4jmnbgqnffqkxks2irpd4agvcxjqth3mj4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a15b39af6ab70fbed561712c684d0694b055d52d222f1f006a8ae984cfb6278

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 8a15b39af6ab70fbed561712c684d0694b055d52d222f1f006a8ae984cfb6278

(this sample)

Formbook

Executable exe 77d1e1c8c87b166c88ab728ff9830a8c7c2da67ce68a5348846fdfa1be8183b3

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 77d1e1c8c87b166c88ab728ff9830a8c7c2da67ce68a5348846fdfa1be8183b3

Comments