MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a0432bd3584468e87660ab8034b919ad26f3d4512054fa4568281b8a9578a20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a0432bd3584468e87660ab8034b919ad26f3d4512054fa4568281b8a9578a20
SHA3-384 hash: 77919e44ec66146b403893587a821508dab144bdfcda32125cbbf3bd06d39c0708ac59f4d8421f61496e35d46c0d759b
SHA1 hash: 70cf9b649ec4145079d8ad025cc34bdc3b342813
MD5 hash: 29776b8a55b9890ea06d2cb034a9ce03
humanhash: neptune-bacon-echo-river
File name:Sample__IMG.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:424'469 bytes
First seen:2020-08-19 12:32:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ZG58rMWHkRw1qeMczkQ4gn8YFPT+Tda/d559:ZG58xuIn4WsTd8bH
TLSH A59423E7018CD9E9EBB0D03E5C3106D2ED55A349A7207DB3828ADC46FB46649DE291CF
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: zmxrelay.ifxnetworks.com
Sending IP: 200.91.200.67
From: gestion humana <gestionhumana@sotrandes.com>
Subject: ORDEN
Attachment: Sample__IMG.rar (contains "Sample__IMG.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a0432bd3584468e87660ab8034b919ad26f3d4512054fa4568281b8a9578a20/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 12:34:07 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nicdfpjvqrdi5b3gbk4ags4rtljg6pkfcicu7jcwqka3rkkxriqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a0432bd3584468e87660ab8034b919ad26f3d4512054fa4568281b8a9578a20

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 6a0432bd3584468e87660ab8034b919ad26f3d4512054fa4568281b8a9578a20

(this sample)

FormBook

Executable exe 889352094880e37d9fb8d07ca965839f595ac5b821996f4290149d1815981a7b

  
Dropping
MD5 1dca9cc9568965d362a359e235daa517
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 889352094880e37d9fb8d07ca965839f595ac5b821996f4290149d1815981a7b

Comments