MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0ea053555dd4d456afb031b969a1923940e9f180682b7bbdbe39c589b7fc4cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0ea053555dd4d456afb031b969a1923940e9f180682b7bbdbe39c589b7fc4cb
SHA3-384 hash: db903aea8500fa990831d4e1e1879c19fbe024e6aa8b03613a1459cf1764caad580bea3dbbf3384108c3d8afe2194bbf
SHA1 hash: e1cda6cac6775ef9ee59f752e0fdd5ccf73c6963
MD5 hash: e8f26b61c534dfb4a7aa4c700a67dceb
humanhash: mike-salami-muppet-blossom
File name:DHL_receipt.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:274'432 bytes
First seen:2021-02-25 14:18:42 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:w9X0GflxE1jGjPLnIvfXY32Xw1xVh89Eh:W0qlxhjPIXY3BtcE
TLSH 784402167150E4B3E47216B00D72366DEFEFA20035B9660FB70C6E59BF53A93560EB42
Reporter abuse_ch
Tags:DHL FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: vps.mochinkini.com
Sending IP: 185.142.24.144
From: DHL <service@strauss-group.com>
Subject: DHL Delayed Parcel
Attachment: DHL_receipt.iso (contains "DHL_receipt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0ea053555dd4d456afb031b969a1923940e9f180682b7bbdbe39c589b7fc4cb/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 14:19:07 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2dvaknkv3vguk2x3amnzngqzeoka5hyya2blpo634oofrg37ytfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso d0ea053555dd4d456afb031b969a1923940e9f180682b7bbdbe39c589b7fc4cb

(this sample)

Formbook

Executable exe 010192b5d3b3e85925fc312177759597b78fa7f6feb282cf3a743aae9f53067d

  
Dropping
MD5 4e56cfba1b9000f76bf1ce38a9ad451b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 010192b5d3b3e85925fc312177759597b78fa7f6feb282cf3a743aae9f53067d

Comments