MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b28197e7b6c5e25313337c79d7d69bffa92a40178643c1f79505eea1310c3eb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b28197e7b6c5e25313337c79d7d69bffa92a40178643c1f79505eea1310c3eb2
SHA3-384 hash: a945e534e75848ce451626f1597fd5919b36cb3bd4bf15408dc46e2adbd493276099c86e1e725a845fc08bc662fcc37b
SHA1 hash: acec1617ef8a3d3a41136519d78b48257d6a74ac
MD5 hash: e32d9d17b648dfe8d18bceb04f275cdf
humanhash: maine-equal-coffee-jupiter
File name:PI6354.img
Download: download sample
Signature Formbook
Create hunting rule
File size:628'736 bytes
First seen:2020-08-18 19:36:33 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:z+7Xs6oXa9oLaAp3CWRIvz1avTsM5OZSjpEAHjcPL:QsH4oLaqCWRyJCslZSVxg
TLSH E8D4E12232D4D674D1B6433ACC99786403FABC06E511DB6EBC8CB2DD1A31F924B627D6
Reporter abuse_ch
Tags:FormBook Hostwinds img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: hwsrv-761734.hostwindsdns.com
Sending IP: 192.119.110.150
From: Wang Lu <office.alger@legrandelectric.com>
Subject: Fw:Re: Enquiry for New order shipment
Attachment: PI6354.img (contains "PI6354.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b28197e7b6c5e25313337c79d7d69bffa92a40178643c1f79505eea1310c3eb2/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:38:10 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkazpz5wyxrfgeztpr45pvu376usuqaxqzb4d54vaxxkcmimh2za._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b28197e7b6c5e25313337c79d7d69bffa92a40178643c1f79505eea1310c3eb2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img b28197e7b6c5e25313337c79d7d69bffa92a40178643c1f79505eea1310c3eb2

(this sample)

Formbook

Executable exe 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23

  
Dropping
MD5 e865f64e36ea59737f07f07cd020ff9b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9ddbf1453097473cfa4eb4c1a28a6f4a2ecdac3b24179e6fd88d3444bf96ec23

Comments