MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 939863edcaf7c655fb6e3020bdfe5138bf6e61faa3d3b037f113216ccc1be55a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
FormBook
Vendor detections: 4
| SHA256 hash: | 939863edcaf7c655fb6e3020bdfe5138bf6e61faa3d3b037f113216ccc1be55a |
|---|---|
| SHA3-384 hash: | 54337c813fee975e9eef7b269286f13d2c1312867725935b411559b187a64305eb2e937460038cdb014add1db691f51c |
| SHA1 hash: | 09a79460db647ec8c12328bfc9b8c4daaa86cf72 |
| MD5 hash: | eec43b73ccd5f26bbaba81ffc080a573 |
| humanhash: | comet-pip-rugby-sink |
| File name: | New Order.exe |
| Download: | download sample |
| Signature | FormBook |
| File size: | 1'259'520 bytes |
| First seen: | 2020-06-15 05:37:02 UTC |
| Last seen: | 2020-06-16 13:17:51 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 134a427d8e11e30f2e4389847cf6bf3c (3 x FormBook, 2 x NetWire, 1 x RemcosRAT) |
| ssdeep | 24576:RBlDgE7EmXWAqSvg439vGSVNe1/hqIiHIVd7:R7DlC+GSjiBioP |
| Threatray | 74 similar samples on MalwareBazaar |
| TLSH | F0456C32B2A1C433D5631A7CDC5B92FC9826BE10A92859877BF53D4CBF39741342A1A7 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing FormBook:HELO: orange11-orange404.mynewserver.com
Sending IP: 185.29.25.171
From: info@lstc-lb.com
Subject: Re: Re: Re: New Order
Attachment: New Order.zip (contains "New Order.exe")
Intelligence
File Origin
# of uploads :
4
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Gathering data
Threat name:
Win32.Trojan.CryptInjector
Status:
Malicious
First seen:
2020-06-15 05:39:04 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
suspicious
Similar samples:
+ 64 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:modiloader trojan
Behaviour
Suspicious use of WriteProcessMemory
Legitimate hosting services abused for malware hosting/C2
ModiLoader First Stage
ModiLoader, DBatLoader
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.