MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19e5f8a354163adaca8a47604cda52a48c95ef1dc733d44e576a794501515ce5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19e5f8a354163adaca8a47604cda52a48c95ef1dc733d44e576a794501515ce5
SHA3-384 hash: 33395b99db13819d276ab4b9af68b75a6a78cf5b66bd828aefa6176f528193d07f5e6d2b28a45692ca74b1c46b4989b6
SHA1 hash: 9bb811006bf986afd9c05465ac29bc7c7089ed58
MD5 hash: c31b10b1e068d2688b17b89571a1fdf8
humanhash: angel-april-maryland-uranus
File name:DHL293413110038.IMG
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-22 13:43:41 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:5OSwqyqhpqQEKO1aqThOJSqKsew3m8mIGgrC:5PD/n0aqYKseum8mIGWC
TLSH D6458D2413CC8557CAADC5B7C0D2590342E8E46E098FA78AECDDA1EA7F573B3D842587
Reporter abuse_ch
Tags:DHL FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: smtp109.iad3a.emailsrvr.com
Sending IP: 173.203.187.109
From: DHL <abiola@fastandfriendlyrx.com>
Subject: DHL Pickup Confirmation DHL293413110038
Attachment: DHL293413110038.IMG (contains "DHL293413110038.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48128.28574.9755.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 14:35:51 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 19e5f8a354163adaca8a47604cda52a48c95ef1dc733d44e576a794501515ce5

(this sample)

FormBook

Executable exe 9374c211fc924cac59bacbe5a688f3a25f740cb324d58b239da0c070b7393749

  
Dropping
MD5 1c3d2dae318e1747e77626592a53186d
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9374c211fc924cac59bacbe5a688f3a25f740cb324d58b239da0c070b7393749

Comments