MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b81ce82327eb158f6799c831d6436721f216e94b4160b6855cf8f1299bf8ed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b81ce82327eb158f6799c831d6436721f216e94b4160b6855cf8f1299bf8ed7
SHA3-384 hash: 5ee863c1d48bacdd62471a7e07ed8e5c93c09d8f49fcc993e16b2f696f52c57509bd20c0958dc7513c1b434eaf6a9d99
SHA1 hash: b2b78f1bfce5e34d2989adaa9979be5c9eff30ec
MD5 hash: 07a199aebbe0e5c5946c3bad18fd001e
humanhash: india-pasta-angel-leopard
File name:shipping Document.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:536'746 bytes
First seen:2020-08-15 10:01:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Yy69zd2103YNE1bxKnNF+Xx46vsEDeoi9yoQ5WAzr:YyOzyiYYxKnNr6rtoQ5WA/
TLSH ABB4233256C955D7EA70B982E481CDF12DBF6047A103C3DE809CD76D3A89FAE354362A
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.h-email.net
Sending IP: 156.96.59.30
From: ''Support''<supportvietnam@dhl.com>
Subject: Delivery Notification
Attachment: shipping Document.zip (contains "shipping Document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.47d3269cf2f5a119.13157.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b81ce82327eb158f6799c831d6436721f216e94b4160b6855cf8f1299bf8ed7/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 10:03:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=boa45arsp2yvr5tztsbr2zbwoipsc3uuwqlaw2cvz6hrfgn7r3lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0b81ce82327eb158f6799c831d6436721f216e94b4160b6855cf8f1299bf8ed7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 0b81ce82327eb158f6799c831d6436721f216e94b4160b6855cf8f1299bf8ed7

(this sample)

FormBook

Executable exe c3aa8bddb8ca445d0908c2d02bbb01470c8998a0fc525847ec619fe7868ac043

  
Dropping
MD5 47d3269cf2f5a1199b2e9c22e722fecc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c3aa8bddb8ca445d0908c2d02bbb01470c8998a0fc525847ec619fe7868ac043

Comments