MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb22f5771789c3eb9c2577dbbe1f6b942845b7a7c3bd0b8e6c11e54827d909f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb22f5771789c3eb9c2577dbbe1f6b942845b7a7c3bd0b8e6c11e54827d909f0
SHA3-384 hash: 2290402c5804288972a7a24aec61c544915ef4461abdc556b586b8267fbda3eff8053a7fdfdc5aef1a6a105613230abc
SHA1 hash: e4abb51242fa2ef894a8f0cd029830488223e17f
MD5 hash: 81ba1306edf5e661f7db17e62979940c
humanhash: pasta-football-massachusetts-sweet
File name:Pfz2O0m5k-july2020-RFQ.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:228'693 bytes
First seen:2020-07-13 06:19:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:A+mkjplILL3o6GK+RQT9l+aOiIDrxZlWjTPAFx:A8mHDIa9EaOdvlWvPAFx
TLSH C024125FB089AC144FECADCE296FE981B13DC98E79F908C54043444447DA9BB25DDAEC
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dlveltex.co
Sending IP: 111.90.145.49
From: EVERSENDAI GLOBLE COMPANY <ge13968@hibox.hinet.net>
Reply-To: ge13968@hibox.hinet.net
Subject: Re: P0 (2020)-2790 new orderJuly2020
Attachment: Pfz2O0m5k-july2020-RFQ.rar (contains "Pfz2O0m5k-july2020-RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb22f5771789c3eb9c2577dbbe1f6b942845b7a7c3bd0b8e6c11e54827d909f0/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 06:21:04 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xmrpk5yxrhb6xhbfo7n34h3lsqueln5hyo6qxdtmchsuqj6zbhya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar bb22f5771789c3eb9c2577dbbe1f6b942845b7a7c3bd0b8e6c11e54827d909f0

(this sample)

FormBook

Executable exe 1520c196804649d5a465a2003046210148f70d50e926366300214cea9ef15719

  
Dropping
MD5 b6076c3f3c090e88a79b3ab2398cb2a5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1520c196804649d5a465a2003046210148f70d50e926366300214cea9ef15719

Comments