MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 affaec3e32d0244aaf424180de568e23d03da3eb6c43dcb0b82b4e5185731abc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: affaec3e32d0244aaf424180de568e23d03da3eb6c43dcb0b82b4e5185731abc
SHA3-384 hash: 35c6c1ae3f730117ae944bfe5152b3a3bb0e8119b98869d88a0f9e93d5a312a48636de603e5aed1f5af33233b489cad9
SHA1 hash: 5c227f6a98ba91dd4f697c6481fb2c7edc554e5c
MD5 hash: 9a4da2f3284b0179325ab5c1aab91db7
humanhash: asparagus-arkansas-undress-tennis
File name:Carta de pago.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:428'032 bytes
First seen:2021-01-16 07:33:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:ixNFYoqeHQPJ3GERo95/shp8wPWFVm04N0dVo:0NFYHeiRg/s78wPWS/0dVo
TLSH E0940703A82C89B2EF38A33E41050DC991F55C5C16D9B22667BDBD3DCA7D4225D1FA2E
Reporter abuse_ch
Tags:CHL FormBook geo iso


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.litos.net
Sending IP: 86.109.108.50
From: Banco de Chile <notices@bancochile.cl>
Subject: Notificacion de pago
Attachment: Carta de pago.iso (contains "Carta de pago.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
351
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.MulDrop16.9685.23053.9345.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/affaec3e32d0244aaf424180de568e23d03da3eb6c43dcb0b82b4e5185731abc/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 19:25:37 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v75oyprs2asevl2cigan4vuoepid3i7lnrb5zmfyfnhfdbltdk6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/affaec3e32d0244aaf424180de568e23d03da3eb6c43dcb0b82b4e5185731abc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso affaec3e32d0244aaf424180de568e23d03da3eb6c43dcb0b82b4e5185731abc

(this sample)

Formbook

Executable exe c15f6faab41ea44719d795995c15024db0719fa5c9a731110587ec4e1e041fc2

  
Dropping
MD5 03206cea63667d5f8e8861f554720473
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c15f6faab41ea44719d795995c15024db0719fa5c9a731110587ec4e1e041fc2

Comments