MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 325758a02acf2941d5c137eee264908cfb83f721ccfc902570e64a3dbcdbeb4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 325758a02acf2941d5c137eee264908cfb83f721ccfc902570e64a3dbcdbeb4d
SHA3-384 hash: ddf5650e705844e797da7776f322e9a7252b98c6c8bfc3add50d28ced9ff3cbc3686046947ea178fe746bf4ed23c1e6b
SHA1 hash: dc1d54f95ee8f2259593b000a757038f295d6c19
MD5 hash: 38120af0aaa9a4155e177e2e947c8b73
humanhash: bacon-grey-comet-cardinal
File name:AWB 67389928.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:235'580 bytes
First seen:2020-05-18 06:26:12 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:ayp0HG8CTM1ntzkYOJ/I9E2nsREZ9VKyGShbLTdKRBuvCA:ayp0HRRzkn/I9UTShHTdKnmCA
TLSH 893423FB822D4085666B6E15F6CE752A1DFBDA35336283F15804F4CF1E1B869A33C468
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

From: "Kirschstein Jorge" <jorge.kirschstein@dhl.com>
Subject: Shipment Notification - (AWB 67389928)
Attachment: AWB 67389928.gz (contains "AWB 67389928.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 06:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gjlvribkz4uudvobg7xoezeqrt5yh5zbzt6jajlq4zfd3pg35ngq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz 325758a02acf2941d5c137eee264908cfb83f721ccfc902570e64a3dbcdbeb4d

(this sample)

FormBook

Executable exe 89a226afd800c763daf6097a05275bb5e100b168e8c3fa46a73807075dcec45c

  
Dropping
MD5 7120183d4d86681c75e815a27b362f4c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89a226afd800c763daf6097a05275bb5e100b168e8c3fa46a73807075dcec45c

Comments