MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37979482fb94c751c9621e70f19ee41d28181db9d7bc0549ff33e179a8082dcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37979482fb94c751c9621e70f19ee41d28181db9d7bc0549ff33e179a8082dcc
SHA3-384 hash: 56db4542e18a80cb798e0be1e2bcafba8ce272a441b70424874b35cb79d8955aed4d13446cbf3460195cc13712481bf6
SHA1 hash: f40d0333b193894435b1ac671a479f2a342c1bce
MD5 hash: a2acdebfce5a86c6ed8c4f08f4845a05
humanhash: freddie-georgia-princess-beryllium
File name:Docs2.img
Download: download sample
Signature FormBook
Create hunting rule
File size:626'688 bytes
First seen:2020-08-18 11:16:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:cD5xkZiE05iCK6sI3UalzXtxuRZk+vPb:m6IE0ICK6dBlXuRe+7
TLSH FDD4D03632D0E634D17A53368CA9787103F9BC16E512E75A7CDCB2CD0A72F564B22AC6
Reporter abuse_ch
Tags:FormBook Hostwinds img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-761734.hostwindsdns.com
Sending IP: 192.119.110.150
From: Jery Lisa <ashley@textileexchange.org>
Subject: Fw:Re: New order for shipment require
Attachment: Docs2.img (contains "Docs2.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/37979482fb94c751c9621e70f19ee41d28181db9d7bc0549ff33e179a8082dcc/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:18:06 UTC
AV detection:
10 of 28 (35.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6lzjax3stdvdslcdzypdhxeduubqhnz266aksp7gpqxtkaifxga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/37979482fb94c751c9621e70f19ee41d28181db9d7bc0549ff33e179a8082dcc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 37979482fb94c751c9621e70f19ee41d28181db9d7bc0549ff33e179a8082dcc

(this sample)

FormBook

Executable exe 15f8cb0332203ee3305fb863a9f833d41266f9be9d677aa7ece33bcee8441498

  
Dropping
MD5 0c2c1c78bc66d3fa8de375a13c149609
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15f8cb0332203ee3305fb863a9f833d41266f9be9d677aa7ece33bcee8441498

Comments