MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22326674a37cc9a107d209ab0f7e2ba836931fb1e3518ef8f4bae77794c488d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22326674a37cc9a107d209ab0f7e2ba836931fb1e3518ef8f4bae77794c488d8
SHA3-384 hash: f33ab8c0b870dacc992dea5b61da4a348daa1720d4d24c66845501e2bde79ad469bdacf689c49bab8cbeac7576452b34
SHA1 hash: 310875a11674e7b88d1f270eb4007f9c40740e56
MD5 hash: 8bed3ccacc1a21e5db3e3e15be38605d
humanhash: quebec-maryland-south-thirteen
File name:New Purchase Order DS2192472-14 135913.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-03 06:43:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:6bkMb0NOaxHJNOcd8MuwTIunLHDkTkmxZ8UMbURo2PG4iBVq2WkO:6gKeTWtqvnLHDilxZfMgRo2eXBdWk
TLSH 4545D0312746FF98D5A48A70712241121E7ABD5B9321E71E7C8C32BC1BF1B89CB567E2
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ap.o-i.com
Sending IP: 23.254.230.68
From: POConfirm-DirectSourcing.com <kelvin.ferguson@ap.o-i.com>
Subject: New Purchase Order # DS2192472-14 & 135913
Attachment: New Purchase Order DS2192472-14 135913.img (contains "New Purchase Order # DS2192472-14 & 135913.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22326674a37cc9a107d209ab0f7e2ba836931fb1e3518ef8f4bae77794c488d8/
Threat name:
ByteCode-MSIL.Trojan.Avemariarat
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:45:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eizgm5fdpte2cb6sbgvq67rlva3jgh5r4niy56huxltxpfgerdma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 22326674a37cc9a107d209ab0f7e2ba836931fb1e3518ef8f4bae77794c488d8

(this sample)

FormBook

Executable exe 1ad1205ec2b4f317ae6857da4d49e11da7debbfc9b40dc46c598ed543152e0e3

  
Dropping
MD5 4baa39a900545253e91c9d616be1abf0
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ad1205ec2b4f317ae6857da4d49e11da7debbfc9b40dc46c598ed543152e0e3

Comments