MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5c2b55ab78871e2bc7135fbd1715a6448354f7194e83b6e935ae31ef4e84c49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5c2b55ab78871e2bc7135fbd1715a6448354f7194e83b6e935ae31ef4e84c49
SHA3-384 hash: a23f6db14bf0960a4a107d9d63c22c9d06244b21cc1eb73abf9944e19a37557e83bcdb69c0c09058b81e1d8ffca43cec
SHA1 hash: 034582ab3340db1802ceb6b0dfcbfff37c2837f9
MD5 hash: 2dd79109ff965e60dc7fd3f3d38ab9e8
humanhash: indigo-nitrogen-jig-crazy
File name:Pago del saldo pendiente de SOA.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:950'272 bytes
First seen:2021-03-26 06:18:17 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:03HDlrpkFeMQwYeKLFotcVSAmkofv0HVKNKw0uRkSctotjAtO1d+vmMeW8d:8DlSFeMQwfKLmtc8Amkofv0HVKNKw0up
TLSH F815B09224ECD195D822BCFCC49BD7E33707CDA78790A78631BCE4526267B9AD11384E
Reporter cocaman
Tags:FormBook iso


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts <info@cpservers.co.in>" (likely spoofed)
Received: "from cpservers.co.in (cpservers.co.in [142.93.203.58]) "
Date: "Thu, 25 Mar 2021 17:46:56 +0100"
Subject: "Pago del saldo pendiente de SOA $ 28,696. 05"
Attachment: "Pago del saldo pendiente de SOA.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.Unclassified.100105.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5c2b55ab78871e2bc7135fbd1715a6448354f7194e83b6e935ae31ef4e84c49/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-25 19:14:26 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
7 of 48 (14.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xblkwvxrby6fpdrgx55c4k2mredkt3rstudw3utllrr55hijreq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/e5c2b55ab78871e2bc7135fbd1715a6448354f7194e83b6e935ae31ef4e84c49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso e5c2b55ab78871e2bc7135fbd1715a6448354f7194e83b6e935ae31ef4e84c49

(this sample)

Formbook

Executable exe 4c84ae992216034d364ea35c6af5ee9c01826688106cf6bdbc32d6fc42584f62

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c84ae992216034d364ea35c6af5ee9c01826688106cf6bdbc32d6fc42584f62
  
Dropping
Formbook

Comments