MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61334f2fd188a04deb282504f45d47d0ce02cd791e62f680e0691e52fe6e499a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 61334f2fd188a04deb282504f45d47d0ce02cd791e62f680e0691e52fe6e499a
SHA3-384 hash: 5e8f1520e2b85d2c8257e0ac50edf3df22e24c657602e08c2780eae07c1a7bd2347f7f6293d8d745d3e348b9f6d5ad0e
SHA1 hash: 9bf09efdf55d455e36e0c096738ed4fdd8f33178
MD5 hash: 1395bbffc460834eb9f7189be60e11be
humanhash: massachusetts-tennis-king-massachusetts
File name:Payment Receipt - PI695164.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:370'237 bytes
First seen:2020-06-29 07:23:15 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:WetLXByU1mt5VuellnGONhyegjxYFBQkSEEPf0dKp9zHxfu4dPwUeW66CG:WeVBdopGORkxYFrgUIxcE66CG
TLSH B3742337BC9EF373A42D294E77887AB4CA77296DC77101E188CA302324257B9C795A43
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mout.gmx.com
Sending IP: 74.208.4.200
From: Cristina Lourdes Buba Simões <cristina.simoes@adexec.com>
Subject: Re: Balance payment
Attachment: Payment Receipt - PI695164.rar (contains "Payment Receipt - PI695164.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/61334f2fd188a04deb282504f45d47d0ce02cd791e62f680e0691e52fe6e499a/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 07:25:05 UTC
AV detection:
20 of 31 (64.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mezu6l6rrcqe32zieucpixkh2dhaftlzdzrpnahanepff7tojgna._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 61334f2fd188a04deb282504f45d47d0ce02cd791e62f680e0691e52fe6e499a

(this sample)

FormBook

Executable exe 0a6caea4ce7bf55029e1f01895a6c653fb2c5166f76dafcf94956dd8915e4eab

  
Dropping
MD5 fa0094d9abd96cd92b80f7bcc51fbd37
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a6caea4ce7bf55029e1f01895a6c653fb2c5166f76dafcf94956dd8915e4eab

Comments