MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58b9ef070518321fd67fea27324eeee25b99318bd5c40bd34b2e33ffb4037d56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58b9ef070518321fd67fea27324eeee25b99318bd5c40bd34b2e33ffb4037d56
SHA3-384 hash: d2ccb98408648c4f9e13eb58f0acbab193d303f1a1fff4a1a32c15648edde4179ceafec4fb16bd37d4b1a309389d6a60
SHA1 hash: 0ac204e6a57a52079bcd3a43bc387fb2154abacb
MD5 hash: 283be86b2919fa598bb3a9dec9d01282
humanhash: echo-berlin-pluto-double
File name:PO PI.img
Download: download sample
Signature FormBook
Create hunting rule
File size:526'336 bytes
First seen:2020-07-31 06:18:26 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:zHuZEaQ+ZpWk/V0G0tu8jWpCyNnCL0y4yxOPlf:zHu6aQ+PT0ttx6Aygh4eO
TLSH 20B4CE7CB0C9550AF5A275BFAFF893A7CEA7F02B5196010B2778209781797192B81F70
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dekruco.com
Sending IP: 5.206.227.64
From: Maria <Kabrijo@t-online.de>
Subject: Re:Re:Re:RE: PO-17000542 Container shipment
Attachment: PO PI.img (contains "PO PI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25544.7zHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58b9ef070518321fd67fea27324eeee25b99318bd5c40bd34b2e33ffb4037d56/
Threat name:
Win32.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 06:20:07 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lc466byfdazb7vt75ittetxo4jnzsmml2xcaxu2lfyz77nadpvla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/58b9ef070518321fd67fea27324eeee25b99318bd5c40bd34b2e33ffb4037d56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 58b9ef070518321fd67fea27324eeee25b99318bd5c40bd34b2e33ffb4037d56

(this sample)

FormBook

Executable exe 8e9f882576a66be70ed5bc204584037087f3bd53d13498126153fb7514f7dd7a

  
Dropping
MD5 9a931b93992bd36af52ea345cef3af98
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e9f882576a66be70ed5bc204584037087f3bd53d13498126153fb7514f7dd7a

Comments