MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 877df31644a31293d6046a85562fba4298e69598f862c38db8f2c68ca75bf783. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 877df31644a31293d6046a85562fba4298e69598f862c38db8f2c68ca75bf783
SHA3-384 hash: 99f250b19946e7551636456fb7a5bbf64fea6275eaa8c98c1365a4888e87de6f466b5bbff89f6b631a683cbb46bb3c30
SHA1 hash: ebee3f6cda96cfef1b7f83550111f04754ef127e
MD5 hash: 911ce26eb8199974cd4fa3c1f0ca07ad
humanhash: lima-romeo-oregon-mexico
File name:Advance TT.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:201'639 bytes
First seen:2020-07-30 08:07:26 UTC
Last seen:2020-07-30 11:17:46 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:mjFbkLM+dtHk+XbfHU++ms3o4OKOoLJnjO3h96H+nC609q1JYTmj/6DIitLf:mjJi73HhHUx2KVnjO3meCrqcAbiN
TLSH 89142330BF35A1B9B9844496DBF5F8230EAD331091E29DA7CAA966FE571DC0312F4718
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

From: info@swt-tools.de
Subject: RE: Advance TT
Attachment: Advance TT.zip (contains "Advance TT.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/877df31644a31293d6046a85562fba4298e69598f862c38db8f2c68ca75bf783/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 08:09:04 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q567gfseumjjhvqenkcvml52ikmonfmy7brmhdny6ldizj2366bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/877df31644a31293d6046a85562fba4298e69598f862c38db8f2c68ca75bf783

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 877df31644a31293d6046a85562fba4298e69598f862c38db8f2c68ca75bf783

(this sample)

FormBook

Executable exe e6b120648d35809064107c751c61d73fd05aede9884be730c60dd4fe9a4ead0e

  
Dropping
MD5 8a749626808c84035d23f56f95e8c2b8
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6b120648d35809064107c751c61d73fd05aede9884be730c60dd4fe9a4ead0e

Comments