MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90728acc37310575b0994624c637ad5c7c6a5105df349fa683360c4b568564ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90728acc37310575b0994624c637ad5c7c6a5105df349fa683360c4b568564ee
SHA3-384 hash: f73cdd512590d596305a03d66ccb283562fc248121250e225c91f2c361c49e2d1c081051248f5a4be5934a6e839c73eb
SHA1 hash: ab347cf61b685aa4047de39743ebe701bdea745f
MD5 hash: 502325387609c6fba1de6e4405eb2913
humanhash: spring-football-mockingbird-papa
File name:awele.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:428'388 bytes
First seen:2020-08-04 07:41:39 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 6144:HaDBE5lbAMBqvkpLpfrfZWMLN53VL10jg1Mc7QfYNaOdIJUP41VoHvUZ9bYCd3M:Hacbb4knjfoMLfVujGQOaOdITOOsYc
TLSH 429423453A6CCFDE40AD8FC707F267F270AA02CABB7949BF98405363E1815056E6762D
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: [139.59.93.136]
Sending IP: 139.59.93.136
From: "김한솔" <khs@clsam.com>
Subject: 세금 사본
Attachment: awele.gz (contains "awele.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90728acc37310575b0994624c637ad5c7c6a5105df349fa683360c4b568564ee/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:43:06 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbzivtbxgecxlmeziysmmn5nlr6guuif342j7judgygewvufmtxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/90728acc37310575b0994624c637ad5c7c6a5105df349fa683360c4b568564ee

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz 90728acc37310575b0994624c637ad5c7c6a5105df349fa683360c4b568564ee

(this sample)

FormBook

Executable exe 61b48926bb6bbe4e308cf6e2c48345f50d2bda94f501915bd00a3139f9808e10

  
Dropping
MD5 d805e55e843151e176e441248e6f50bb
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 61b48926bb6bbe4e308cf6e2c48345f50d2bda94f501915bd00a3139f9808e10

Comments