MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32b18e9d2f1e8a4685c9ce531bcd0934febdc7592ff407b7054e5b79063fcb1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32b18e9d2f1e8a4685c9ce531bcd0934febdc7592ff407b7054e5b79063fcb1b
SHA3-384 hash: 46d3247667c2b4b98945b7e0746b7a7f3e75b4fcd412728e6a472c07c353cac2361aeed63d52d7b852cda5f8e78d1efd
SHA1 hash: ba47f222daf66074850f994c1cd51fda7c09f718
MD5 hash: 8fab3cf30a39fdb9e83f5f9cc1702d9e
humanhash: july-edward-queen-magnesium
File name:HSBC Payment Advice.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:277'871 bytes
First seen:2020-05-28 16:44:27 UTC
Last seen:2020-05-29 08:18:02 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:aKjXujGlGG9FjEMJB0hlyOFSaqrx7VSivoumWHWzAti2Fst:RhlGGfToFSaqrTlUAtNw
TLSH 1744231A0FD50D0E8D4D699C7B4A0386F4DEA9D98C682C78BC0087488F5456BFDEEDE9
Reporter abuse_ch
Tags:FormBook HSBC rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ip-143-95-1-124.iplocal
Sending IP: 65.75.136.136
From: HSBC Advising Service <info@hsbc.com>
Subject: Payment Advice - Ref: [HSBC1057025201] / Priority Payment / Customer Ref: [PI107057QT20]
Attachment: HSBC Payment Advice.rar (contains "HSBC Payment Advice.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 17:36:16 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 32b18e9d2f1e8a4685c9ce531bcd0934febdc7592ff407b7054e5b79063fcb1b

(this sample)

FormBook

Executable exe a5a17e29758a200bd8bd3805f5b1f292a236ee994274033ee1953ec7e9690db3

  
Dropping
MD5 3fa896fb15113a55eef386e3c00c6897
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a5a17e29758a200bd8bd3805f5b1f292a236ee994274033ee1953ec7e9690db3

Comments