MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3de9b75931d4679c1f1f2407142c9f5d1349f82a83e771c3893b30f2dc5bf5e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3de9b75931d4679c1f1f2407142c9f5d1349f82a83e771c3893b30f2dc5bf5e2
SHA3-384 hash: 2705f1c9dc527c26cf867d828503c808cbe4a1c479ea64eeb78498b3b91bac0f296cae4aac858fd233250a85559a75e4
SHA1 hash: 3dbf79fa78f24fbd63ec79ec8d84fcb97e3086a3
MD5 hash: 465398a96fa2e3bfec8a603ef8639203
humanhash: ceiling-tango-hot-timing
File name:New.Invoice.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-19 05:46:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:SfLk8CPa4LWhA46QlaJsElwTfn3Y1YN4shXDzdki:STr4Ln2aCswLI24shzzdk
TLSH 94458C21A56CDDBCD13F4177BA92CD6A8ECE4CB3205E4C19E4BCF340CA7D682C596266
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.huclangia.tk
Sending IP: 64.52.172.117
From: VITECH S.R.L <info@vitechsrl.it>
Subject: Please find attached SWIFT copy
Attachment: New.Invoice.img (contains "Swift.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-19 09:13:40 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxu3owjr2rtzyhy7eqdrile7lujut6bkqptxdq4jhmypfxc36xra._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 3de9b75931d4679c1f1f2407142c9f5d1349f82a83e771c3893b30f2dc5bf5e2

(this sample)

FormBook

Executable exe ed1cf9eefa4217ae91026ef61399f2c7a56110944d7be5c0b9459704453ea639

  
Dropping
MD5 dacfe9fb5b30790a96cf0fa6447446d4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed1cf9eefa4217ae91026ef61399f2c7a56110944d7be5c0b9459704453ea639

Comments