MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3cf0988a223843642243614aa17aa0f15ca14a1914ef818fed9b1938da87f57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3cf0988a223843642243614aa17aa0f15ca14a1914ef818fed9b1938da87f57
SHA3-384 hash: d43d12df24764d922c0c6df069a65fc3de5745af2c63086a24b0b93ea7fec365d5c73caeeb707ad7b80483ab595125d2
SHA1 hash: f3b970071026006d615207c6a9ce81e7d4064ffa
MD5 hash: 1d9e07fc795f8873886f8b128e8f22f2
humanhash: thirteen-helium-golf-arizona
File name:PO_2020-JANUGHU.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:484'433 bytes
First seen:2020-07-08 06:29:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:j6ToaZ3fTzdPMcco/1ddKcFogt9MSTmpO06rYD6lD3iZ7r4zaVLg5ZsRqLbzCtMo:zWP3RZcQdgY71akQMDbziMW/FTR1sJw
TLSH 57A42395FD520A4D1CFFB8B630A4059BAE424CC62D3E4D5EBF9783BB2050790EAD4B91
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: truegreen-cn.cam
Sending IP: 111.90.140.74
From: Benita Rodrigo <benita.rodrigo@qualitech-solutions.cam>
Subject: RE: URGENT ORDER AND PACKING INSTRUCTIONS
Attachment: PO_2020-JANUGHU.rar (contains "PO_2020-JANUGHU.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3cf0988a223843642243614aa17aa0f15ca14a1914ef818fed9b1938da87f57/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 06:31:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uphqtcfceocdmqregykkuf5kb4k4uffbsfhpqgh63gyzhdnip5lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar a3cf0988a223843642243614aa17aa0f15ca14a1914ef818fed9b1938da87f57

(this sample)

FormBook

Executable exe b8fb24fed506f2b66406af4f29a8a0522564d337d9f374c3936b369e10a69437

  
Dropping
MD5 67c9976e236f532d67bfc92b7ce96d77
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8fb24fed506f2b66406af4f29a8a0522564d337d9f374c3936b369e10a69437

Comments