MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cea867ece0089b2bdb51424e81d2f9bd31c80f5c3910fa17bce6c7a36eaed66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cea867ece0089b2bdb51424e81d2f9bd31c80f5c3910fa17bce6c7a36eaed66
SHA3-384 hash: 8a7f3db6c5a11aa5973154d080d1d0b2c3acdaec5d13bc135048e6a9d7cbcc543a03e9f803feaa675ff942bbc16c715c
SHA1 hash: 626f1dbaea39422e92793f49eef0733611f70a3b
MD5 hash: 6d254b56f45f05c290a88d0308accf84
humanhash: snake-lima-fish-white
File name:S-19799C.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:405'640 bytes
First seen:2020-05-14 06:35:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:J2PZCHABqPOwm5g6GMJOa44HGktsxdLJTwGONI:J2Eio4O0LtMvqI
TLSH 5A84237B038321A6EAE2539BC4776DEFDCC4F4C092172AC9975BDB18E9091D11C9BC28
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.honeywell-egypt.com
Sending IP: 204.93.168.246
From: Standard Chartered Bank <AdviceID@sc.com>
Subject: SCB - Advice of Refusal
Attachment: S-19799C.gz (contains "S-19799C.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-14 03:51:09 UTC
File Type:
Binary (Archive)
Extracted files:
318
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftvim7woace3fpnvcqsoqhjptpjrzahvyoiq7il3zzwhunxk5vta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 2cea867ece0089b2bdb51424e81d2f9bd31c80f5c3910fa17bce6c7a36eaed66

(this sample)

FormBook

Executable exe 55c852b0c762e30f96e7948cd2db3f940f8a18714f4c8146775d65e53f9fd385

  
Dropping
MD5 d7bd3e606c11ebcf2262604c19538bcf
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 55c852b0c762e30f96e7948cd2db3f940f8a18714f4c8146775d65e53f9fd385

Comments