MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff0eb718e5edcd46894e57298e33bc06055f302ebfb3b8048e6a5b703621be94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff0eb718e5edcd46894e57298e33bc06055f302ebfb3b8048e6a5b703621be94
SHA3-384 hash: 065c1ecc7b5f9c766c4c7c3de093d0cab6d4a2c35cd1528f1b8c2924ea7a85c0a28268e96111465d91c59ac6de6e914f
SHA1 hash: 520cfc915f113ca3594c323f486f97c33bf2d28e
MD5 hash: 9eb1d60f17a6242cbb455b54714e2ee4
humanhash: texas-sad-white-west
File name:payment copy.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:1'087'488 bytes
First seen:2020-04-02 06:56:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:bHOS/q+zVvGErwnhRwslIds9U3mOq7AZVTgZ2V+zVvGErwnhRwslIdsL28:qvWihRwsGouJq76pgZKWihRwsGj8
TLSH 9A35E158539C4D7AD68F0378D0A901D0A7F29117B18EEBAE784A7DF95F4F3D2A806183
Reporter abuse_ch
Tags:COVID-19 FormBook iso


Avatar
abuse_ch
COVID-19 themed malspam distributing FormBook:

HELO: raisechem.com
Sending IP: 155.94.211.4
From: sales@raisechem.com
Subject: Payment Assistance Due To Covid-19 Pandemic
Attachment: payment copy.iso (contains "payment copy.com")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.37378.31410.28613.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-02 07:35:45 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=74hloghf5xgunckok4uy4m54aycv6mbox6z3qbeonjnxanrbx2ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso ff0eb718e5edcd46894e57298e33bc06055f302ebfb3b8048e6a5b703621be94

(this sample)

FormBook

Executable exe 2bde030373678bb2df1223cd3e3c4e7f2992e30739dcc63b688368f02a100067

  
Dropping
MD5 eccf9e17e707699c7cffcc212bb7e7cc
  
Dropping
SHA256 2bde030373678bb2df1223cd3e3c4e7f2992e30739dcc63b688368f02a100067
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2bde030373678bb2df1223cd3e3c4e7f2992e30739dcc63b688368f02a100067

Comments