MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7138d86796a26e1614e0d9c7c6080dde9af0a9730cc612f03779af06d8025f31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7138d86796a26e1614e0d9c7c6080dde9af0a9730cc612f03779af06d8025f31
SHA3-384 hash: 21c4ac05762445c3decf5640fe697b6d822694f75b7148693b0264a42ed0323ce9bd7be2a26b85ea440fba4f2218b7fa
SHA1 hash: 3005bbefd4bb1c4d4318f88c5283c2c02d051011
MD5 hash: 6f1e8e74ce257c9aeb4141264654482a
humanhash: robert-winter-neptune-georgia
File name:Scan_03062020.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-03 11:49:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:LrmGuAPtPzBvdAevUofAKcyLgjkjhh8JMcuajWYnEjRFBkVF8rZYzFS6VTOeqva:L3z1rRNxLT9hQuajWF0ZFS6VT
TLSH B445BF0136916E8FC53E4E76842208109770EE736E4AF347BDCB31DA5A3EBCA4A15797
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mout.perfora.net
Sending IP: 74.208.4.197
From: Darin <darin@interstatebatteriestampa.com>
Reply-To: Darin <darin@interstatebatteriestampa.com>
Subject: RE: Order 03062020
Attachment: Scan_03062020.img (contains "Scan_03062020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 12:42:46 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
11 of 31 (35.48%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oe4nqz4wujxbmfha3hd4mcan32npbkltbtdbf4bxpgxqnwacl4yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 7138d86796a26e1614e0d9c7c6080dde9af0a9730cc612f03779af06d8025f31

(this sample)

FormBook

Executable exe 7c479cfb9c3df15b565e16fc62709d8af849773c5112b53bf4d41f939219d6d8

  
Dropping
MD5 8d51b575454e6d89726161de5110c347
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c479cfb9c3df15b565e16fc62709d8af849773c5112b53bf4d41f939219d6d8

Comments