MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f3b3d10b4e5560f6926d942422ecacec4e38c15ccf132b5fc6d5531a53ead1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f3b3d10b4e5560f6926d942422ecacec4e38c15ccf132b5fc6d5531a53ead1c
SHA3-384 hash: 53b30891bbfe48685adae6293490451f64dc0eaa1c5095ecfa876df8320c22786267d11553fb4ff0c8d3a904a6fa720b
SHA1 hash: a3ae6b0e08042ae2b8a3255616df44619f5cec36
MD5 hash: 472ebc901a334a87afc4fc95a925a556
humanhash: maine-romeo-alpha-three
File name:PO81053.ISO
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-01-19 13:05:31 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:4YrCpB4eJzT85MwXbHEp0+Pcm5moEUQzu:1CpBHF8RoPcm5Gxz
TLSH 164502759FC49E32E085C1F68C2153E94976A891330652EBF7DC3C3A2B2DA91E63854F
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: box.perfesdar.xyz
Sending IP: 165.22.228.79
From: Engr. Wafa Tafariq<info@perfesdar.xyz>
Reply-To: <friding7@gmail.com>
Subject: RE. New Order
Attachment: PO81053.ISO (contains "PO81053.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f3b3d10b4e5560f6926d942422ecacec4e38c15ccf132b5fc6d5531a53ead1c/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 12:28:18 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t45t2efu4vla62jg3fbeelwkz3cohdavztytfnp4nvktdjj6vuoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f3b3d10b4e5560f6926d942422ecacec4e38c15ccf132b5fc6d5531a53ead1c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso 9f3b3d10b4e5560f6926d942422ecacec4e38c15ccf132b5fc6d5531a53ead1c

(this sample)

Formbook

Executable exe f5a88909c2272b7ddba37b210ca2bbf79c4baf80e51f883a36e5887183b84d3b

  
Dropping
MD5 133bddae88916c0016892d2cf55b6d8a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5a88909c2272b7ddba37b210ca2bbf79c4baf80e51f883a36e5887183b84d3b

Comments