MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53d11b71b365a0f71fac535aa9a7aeac2079008eb55993987fc7f226e94d0135. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53d11b71b365a0f71fac535aa9a7aeac2079008eb55993987fc7f226e94d0135
SHA3-384 hash: 045b74d7de11c97c7178e67645e04f7c56e25292a85954f7056003c65aa1ac64e527b8d360c368094043c4570040ca8e
SHA1 hash: 6248e29b2043f4cf0f1af2399eed57f70f29f332
MD5 hash: b96adeece10a3cb2ff5c6a11bc1f0721
humanhash: jersey-queen-december-yankee
File name:New order list Aug.ARJ
Download: download sample
Signature FormBook
Create hunting rule
File size:343'476 bytes
First seen:2020-08-12 06:54:30 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:mbmOpNQxNM+rfXkvBZWxuiTGWj0oNuALh3Ot+FCbHHdpIxHKGvrn:DUoNM+r/kvB4xuiCWYsgAobkxH5Tn
TLSH FC7423DFFE52624D4D2C2CEC729729AE9F140C32BD7CCAD1400A8957B98A13E3751696
Reporter abuse_ch
Tags:arj Endurance FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: sales@hinet.net
Reply-To: roadtriip25@gmail.com
Subject: NEW ORDER LIST
Attachment: New order list Aug.ARJ (contains "New order list Aug.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53d11b71b365a0f71fac535aa9a7aeac2079008eb55993987fc7f226e94d0135/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:56:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpirw4ntmwqpoh5mknnktj5ovqqhsaeowvmzhgd7y7zcn2knae2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/53d11b71b365a0f71fac535aa9a7aeac2079008eb55993987fc7f226e94d0135

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 53d11b71b365a0f71fac535aa9a7aeac2079008eb55993987fc7f226e94d0135

(this sample)

FormBook

Executable exe 0b3026ef214d1740de18fa48e13d8c5bddf67737a33fc07eabe0281f88f2ff5d

  
Dropping
MD5 2b2c2da72259dccc20640055b548cab9
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b3026ef214d1740de18fa48e13d8c5bddf67737a33fc07eabe0281f88f2ff5d

Comments