MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75578cc43cd05f1f12fafa2fb898c0b3875fe550a52dfe09dc7ff2cf7ee2eacd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75578cc43cd05f1f12fafa2fb898c0b3875fe550a52dfe09dc7ff2cf7ee2eacd
SHA3-384 hash: 9a30a38bd81265bbdbf4c20dc47c855d83f2679b7c4d15487a660614a03d45df26fb08b038e4d1bb34c0883da1328feb
SHA1 hash: 0c49837e8ee71ff1a9bb252f3de7e0c6759ba63e
MD5 hash: 5277c70ca6370565a4c0e56d5e4678ba
humanhash: single-jupiter-batman-charlie
File name:Salary.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:275'383 bytes
First seen:2020-06-10 11:38:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ZAgXpiyetyqcxcDJ4KiTsD43W+032OOQZtWx5kW7xUmUFmA7RRnGhNr:2kWIxEJ4KiwD43/032QU5alRniNr
TLSH AB44230B66DBD5DB4C82AF70B8DA945DCE7BACBC428558DB19F813270E1541E4B3832E
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

From: HR Human Resources manager <Hr@bottega-digitale.it>
Subject: YOUR EMPLOYMENT STATUS
Attachment: Salary.zip (contains "Salary.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 11:40:06 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ovlyzrb42bpr6ex27ix3rggawodv7zkquuw74co4p7zm67xc5lgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 75578cc43cd05f1f12fafa2fb898c0b3875fe550a52dfe09dc7ff2cf7ee2eacd

(this sample)

FormBook

Executable exe 9c5d88a1518cd310e763757d9acd267ed5741d6c79036e1053381729a0d700ca

  
Dropping
MD5 3abc3bd58ec7ecd38e1f25823a3a1833
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9c5d88a1518cd310e763757d9acd267ed5741d6c79036e1053381729a0d700ca

Comments