MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 488d022734e600b8045592f15ee0ac29d4bab4a3e01b29a71e0875bb3c1d70c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 488d022734e600b8045592f15ee0ac29d4bab4a3e01b29a71e0875bb3c1d70c4
SHA3-384 hash: 6daf43630aaddf7f8330e859527ba1ad72e897324d9ea63f4611b2c6c118c99f2f6768a935a9cf4dee2e455c1890f1d8
SHA1 hash: c6de078e953ccd697470b3c64faa90b2dd514876
MD5 hash: 2f39af1df6b3a99220dec6d5fb2b17c3
humanhash: mike-arkansas-aspen-fourteen
File name:Quote.Gz
Download: download sample
Signature FormBook
Create hunting rule
File size:667'836 bytes
First seen:2020-06-17 06:00:32 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:cnWPrnpq9QOKdnkHDdJcWYGdQ4wJCCFGoJsG+BqYzKQ:iKdq9/KdkjncGdQ5goJsLQY3
TLSH 87E42322E520A2C7D56C6ACD5F676D8A104031E4DF7EFA8B85DFF1CDAB951C328814C6
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: galileocambodia.com
Sending IP: 107.174.142.107
From: . Alisa Yuan <orion@galileocambodia.com>
Subject: 回复报价 BDMC 2020
Attachment: Quote.Gz (contains "CAacA4cjQPS0oyJ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 06:02:10 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcgqejzu4yalqbcvslyv5yfmfhklvnfd4anstjy6bb23wpa5odca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz 488d022734e600b8045592f15ee0ac29d4bab4a3e01b29a71e0875bb3c1d70c4

(this sample)

FormBook

Executable exe 46d500e1f512e941b4c282d92908fb244439bede7a604381f761823d66f8ba2f

  
Dropping
MD5 78ec03c876afc9c1e4926e21d101d90a
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 46d500e1f512e941b4c282d92908fb244439bede7a604381f761823d66f8ba2f

Comments