MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 869872ec0f82b46065e15b7af980300ceb755a14600525cc1a13edd40185ed07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 869872ec0f82b46065e15b7af980300ceb755a14600525cc1a13edd40185ed07
SHA3-384 hash: 419ee70cd1d0ec3241ac974202b7d097cebea636b160e0cd43e34b7bfd6ace686a351c929e10cfa83a1fd8f9cbc04bf1
SHA1 hash: 9d87ef6270a08d7ba63e5d55bd24f1472744b0ce
MD5 hash: ed260be88b3e35b61eeca4e4d3609a9b
humanhash: tango-timing-helium-hot
File name:Quotation.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:415'621 bytes
First seen:2020-08-18 11:42:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:aaw4A0JkyhM4N4YRoLrI4O9ie7BQxacvSzaB:aSJkF4N4YkrO94vSzaB
TLSH 1C9423BF52107BF764AB5BD647EECC6FF602BFA23A420293231F981D5A58D24D1A6500
Reporter abuse_ch
Tags:FormBook Hostwinds zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-764661.hostwindsdns.com
Sending IP: 104.168.215.186
From: Arun Sharma <info@aleninu.us>
Subject: purchase order-009764327
Attachment: Quotation.zip (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21199.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/869872ec0f82b46065e15b7af980300ceb755a14600525cc1a13edd40185ed07/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 11:44:09 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q2mhf3apqk2gazpbln5ptabqbtvxkwqumacslta2cpw5iamf5udq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 869872ec0f82b46065e15b7af980300ceb755a14600525cc1a13edd40185ed07

(this sample)

FormBook

Executable exe 327254ffbd59cf2ac7038d509ace922665282b3d0cdc2eed9751d7bfe2b38f0f

  
Dropping
MD5 f9ab007852042db9298278c32a00dd20
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 327254ffbd59cf2ac7038d509ace922665282b3d0cdc2eed9751d7bfe2b38f0f

Comments