MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9cb7d2d3277b3ba0c8c9c2bbdc89c2990b9d91091ce7e6331b15e0817cebacb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9cb7d2d3277b3ba0c8c9c2bbdc89c2990b9d91091ce7e6331b15e0817cebacb5
SHA3-384 hash: a8833c813b5d8d43e03b2918811fa88adcb9b92e8c07dc13ea5f1a1e18719456bcdfc9d14097d3a849575d41eb492cdb
SHA1 hash: 5e7016dd096f3dbf88052063674c8203184a922b
MD5 hash: d0c68b3025ee9fa4440ea9695713dff5
humanhash: victor-lamp-cardinal-triple
File name:20210303948387477467,pdf.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:286'720 bytes
First seen:2021-03-03 07:27:28 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:X8LxBjAyxtnAk3Z6cnOUncDnOqOyKE6s5IDuiBnjsX:CdtnAk3ktUcDfqii9ja
TLSH A7540216E3E2A8F3E58706708A7769BDF277920404324907375D0DBEAB5365F8A1E393
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.suministroscarmelo.com
Sending IP: 146.255.103.156
From: Junghun Min <h_uchiya@sanmatsu.com>
Subject: 지불 송장 1687
Attachment: 20210303948387477467,pdf.iso (contains "20210303948387477467,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_badexts72.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9cb7d2d3277b3ba0c8c9c2bbdc89c2990b9d91091ce7e6331b15e0817cebacb5/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 02:37:09 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ts35fuzhpm52bsgjyk55zcoctefz3eijdtt6mmy3cxqic7hlvs2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9cb7d2d3277b3ba0c8c9c2bbdc89c2990b9d91091ce7e6331b15e0817cebacb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 9cb7d2d3277b3ba0c8c9c2bbdc89c2990b9d91091ce7e6331b15e0817cebacb5

(this sample)

Formbook

Executable exe d0186c586f083b92225e7a7e3d357e84d7f756a3e7fd76c5edca5f3e1e702ada

  
Dropping
MD5 e79c5035be71a3d0f847fed5d05d64df
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d0186c586f083b92225e7a7e3d357e84d7f756a3e7fd76c5edca5f3e1e702ada

Comments