MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d
SHA3-384 hash: 70aebe96719350895f176d2081313dd5193bc664d1d785521a1919d7226ad0cd2778f9cace9a24b7846dc6bf725f1d8e
SHA1 hash: e7bc1928b3925283c9250960c300e1b99bc99894
MD5 hash: 277df4943e7cae4b07b7a60e6c27bf36
humanhash: massachusetts-nineteen-tennis-beer
File name:нова поръчка.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:377'028 bytes
First seen:2020-08-13 11:19:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fO9VbV9cjy3X1RhUApCoh84CvwnfLTuOVJv/aIABmVyUoaI7vQLhsKAzTCjIkKpt:fOh9MGtUWDtnfLVn/a5myUoa6vQLZ5KX
TLSH 068423CC75C22025327E7A75CBA40B455686B4C5FE71145F9AAAB381913ECAB09E2CF8
Reporter abuse_ch
Tags:BGR FormBook geo zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Skountzos Daria <parts@titanmachinery.ua>
Subject: Re: Re: покупка на нова поръчка
Attachment: нова поръчка.zip (contains "нова поръчка.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.31686.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:21:08 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dc2m24ugjtz2y26rnh5n7jw3c4ouths7xpkxsxvdmjoqdul5h4oq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 18b4cd72864cf3ac6bd169fadfa6db171d499e5fbbd5795ea3625d01d17d3f1d

(this sample)

Formbook

Executable exe c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797

  
Dropping
MD5 0552dc2eb77ff766b362f1cdef722a14
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9b141757defd483a6ff17438e86be87e0c1e5bc3d943c15989d84f577def797

Comments