MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f00751e7161ec82e8040b85ec2a884598e621984fd1aa541b504c0b732ce5008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f00751e7161ec82e8040b85ec2a884598e621984fd1aa541b504c0b732ce5008
SHA3-384 hash: 2eddd812e878c2830de021de3aeb693b45836fe5f116fc4f7f50e86975181e1baa7fae08aa96a349b3ef461c9806eb79
SHA1 hash: 2268efbc6572efc9ecce767283e37deecab02990
MD5 hash: 1021e1aab271c0e926bfbefc457cd676
humanhash: pip-monkey-king-illinois
File name:Solicitud de presupuesto.iso
Download: download sample
Signature Formbook
Create hunting rule
File size:536'576 bytes
First seen:2021-01-14 20:02:15 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:C9iJQqkXT/DHQ1AOsOpj0doNFP8RVf0S+ZmlYfrTDHOgtBxzA9k:CIJQqkDbHQ1eWNFPKsZmyjfugzpAy
TLSH ACB48E03A96C84B2EF38A33E40444DD691F51C5C02D8B16A67BCBD3DCA7D5625D2FA2E
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: SITECH Srl Bolivia<manager@sitech.bo>
Subject: Request For Prices Of Materials
Attachment: Solicitud de presupuesto.iso (contains "Solicitud de presupuesto.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.25486.7294.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f00751e7161ec82e8040b85ec2a884598e621984fd1aa541b504c0b732ce5008/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6advdzywd3ec5acaxbpmfkeelghgegme7unkkqnvatalomwokaea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f00751e7161ec82e8040b85ec2a884598e621984fd1aa541b504c0b732ce5008

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

iso f00751e7161ec82e8040b85ec2a884598e621984fd1aa541b504c0b732ce5008

(this sample)

Formbook

Executable exe 8dcbbb73c0afe52777190faea7b3c0c5bf89407a20d1e24784e7afe7f163ba1a

  
Dropping
MD5 c210b2139d4b19d8f5f737f45e893289
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8dcbbb73c0afe52777190faea7b3c0c5bf89407a20d1e24784e7afe7f163ba1a

Comments