MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d60e9ab73d3f2de058b48885cd6312590ef49ee69f4ccfc46ded5c91612b414. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d60e9ab73d3f2de058b48885cd6312590ef49ee69f4ccfc46ded5c91612b414
SHA3-384 hash: edc4d90f515bef4a22d67ec2214b9547a9366b7bf45f6f83f157c545fb9b14b3f7231228a97b2f41c3e17f85dcf94c71
SHA1 hash: a254d8155821d6d9ab554a026d79da10c5415d59
MD5 hash: ff5be4e379175ebd2351d3f3dd596fae
humanhash: whiskey-spaghetti-lake-cardinal
File name:ORDER08182020.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:474'706 bytes
First seen:2020-08-18 11:10:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:hLTlGtgSzcT4xCT5HQJ10jg33u7nbwHKp2y/:hLx8gS4T4xCTmLHuYk2S
TLSH 4EA4232903960A36BBFB42AD6C5872D9DF35189FC2EB84D58EF172B620727067D47B01
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Isabella Pellegrino <seaworld4@seaworld-distribution.com>
Reply-To: seaworld4@seaworld-distribution.com
Subject: Fw: RE: ORIGINAL DOCUMENTS PART TWO 08182020CV
Attachment: ORDER08182020.zip (contains "ORDER#08182020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d60e9ab73d3f2de058b48885cd6312590ef49ee69f4ccfc46ded5c91612b414/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:12:09 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvqotk3t2pzn4bmljcefzvrrewio6sponh2mz7cg33k4sfqswqka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 5d60e9ab73d3f2de058b48885cd6312590ef49ee69f4ccfc46ded5c91612b414

(this sample)

FormBook

Executable exe ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5

  
Dropping
MD5 8ef0ae4c150733c32e6ab39bd3e536f6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec24550a9fa2fdb2a0e7c739b9ac97387925808dbd832b11675f18e48a93bcc5

Comments