MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b794bc0a5bfc2e14d89d93fd3862a5f1b14216f3e7e33985dca6eb475fdf7fe0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b794bc0a5bfc2e14d89d93fd3862a5f1b14216f3e7e33985dca6eb475fdf7fe0
SHA3-384 hash: f90e43c5d5e43bbd847386e049df72a29eee3010821551ac0ec1fbe4f5215adcca84e043348daa34c2feb3c319e3559b
SHA1 hash: dec47f427b4703b5413a58b4a8b5c969314bd667
MD5 hash: ab678a69bb4da9d6e793feef44d30453
humanhash: arizona-charlie-pennsylvania-sixteen
File name:invoice.img
Download: download sample
Signature FormBook
Create hunting rule
File size:819'200 bytes
First seen:2020-07-20 07:16:07 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:Gu5C1q9I6/kldSCPMi8AyalhciQDyaod+ik4g8y3SoD:Gu5CO20AyOnQW2rEloD
TLSH 7205D0FC9A944500D6ED3FB69E629BB50737BD05F1F2920F2BC4A85B2A37392C854325
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: wisxel.com
Sending IP: 5.206.227.51
From: Jessica <info@staiq.ac.id>
Subject: Fw:Re:Re: Container shipment order clear PO009844132
Attachment: invoice.img (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52265.32307.29161.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b794bc0a5bfc2e14d89d93fd3862a5f1b14216f3e7e33985dca6eb475fdf7fe0/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-19 22:57:43 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w6klycs37qxbjwe5sp6tqyvf6gyuefxt47rttbo4u3vuox67p7qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legal
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b794bc0a5bfc2e14d89d93fd3862a5f1b14216f3e7e33985dca6eb475fdf7fe0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img b794bc0a5bfc2e14d89d93fd3862a5f1b14216f3e7e33985dca6eb475fdf7fe0

(this sample)

FormBook

Executable exe c29ba90d51de3251d2d6f890bf889bd2772c2e375c7df46b25968ae2b1cce5f8

  
Dropping
MD5 e8fb5d7c925042560102b1bd0fe2a40b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c29ba90d51de3251d2d6f890bf889bd2772c2e375c7df46b25968ae2b1cce5f8

Comments