MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5049fa6ca3b2928cd695875eaf85e49b2f0c4d79719346c2b37893e32e5a297b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5049fa6ca3b2928cd695875eaf85e49b2f0c4d79719346c2b37893e32e5a297b
SHA3-384 hash: da753b842e7bb98cfa78fabae6eaa62d20fc38933f3e980f2f71c860cedd5884b9d9354952f1e60aa1b294baf5ebcbfc
SHA1 hash: b0889eaa9c930563546b6237d8090b88257fcc21
MD5 hash: cf11c1631f4a4ad254482fa318a77469
humanhash: magnesium-south-kilo-nitrogen
File name:Attached is the list of the new order.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:364'452 bytes
First seen:2020-07-06 06:23:53 UTC
Last seen:2020-07-06 07:45:47 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:L4lwV/hYYoMGU5gg3FeWBgY1p0Aid8dfyJyrIIacRx+NWycjH3HYJV7I1GU8b:slwV/71dggVZB1p07Hl2+NWyiH27I6
TLSH 927423E02A52AE21D4B6C7B2AAFD9E11944D23D1D2837AC9C23B5D24319B773534CDF4
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: h2816080.stratoserver.net
Sending IP: 85.214.226.43
From: Wissam Abdeen Gevo <gevo@gevomaritime.com>
Subject: Re: Re: new order,
Attachment: Attached is the list of the new order.zip (contains "Attached is the list of the new order.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5049fa6ca3b2928cd695875eaf85e49b2f0c4d79719346c2b37893e32e5a297b/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:25:06 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kbe7u3fdwkjizvuvq5pk7bpetmxqytlzogjunqvtpcj6gls2ff5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 5049fa6ca3b2928cd695875eaf85e49b2f0c4d79719346c2b37893e32e5a297b

(this sample)

FormBook

Executable exe be29f9be4b998a7893c2c182c972406067eaf913364484a1fa824133d71ef54f

  
Dropping
MD5 63e5617320dbc93f53d5f474a9b97e02
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be29f9be4b998a7893c2c182c972406067eaf913364484a1fa824133d71ef54f

Comments