MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31
SHA3-384 hash: fbf4186638b3edf013ee2bc4392c4b68d1ea891a4cb4e3d5468704d119a50487ada052d14bc3c02397a1538e31e43642
SHA1 hash: 712bffd28247afb1ce067c4d1610b694d3b488ef
MD5 hash: 25aaffcd1a4954ef5167faeb4af2374b
humanhash: don-mountain-tennis-lion
File name:Booking confirmation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:964'134 bytes
First seen:2020-08-05 06:47:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:NllbUlF4foJVUexZd0YV6Mq/1LJ3rT1iYHzSScddnpc:3lQlFeL+dF6f1LJ3VeRdc
TLSH E425332F59F1658F655B662C565423A7433DF4E3669BF2708807DCA038CF881CAC8EB6
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.120
From: BOOKING.COM <admin@booking.com>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION
Attachment: Booking confirmation.rar (contains "Booking confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:49:07 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdimsc5inl7lfoac25m7zeodb3mk3p3wz3nrczfzt2knrp7epmyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a8d0c90ba86afeb2b802d759fc91c30ed8adbf76cedb1164b99e94d8bfe47b31

(this sample)

Formbook

Executable exe 0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32

  
Dropping
MD5 0b935188080502f956692bf5c3090949
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0418e3df48284da14ab4d183c6d5d6ec3f37e3bd2b7be5439840d8409e620c32

Comments