MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf53fbf49a6857d3b107d4b9deef148be8bce683717a81810b291f40e3b37be0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf53fbf49a6857d3b107d4b9deef148be8bce683717a81810b291f40e3b37be0
SHA3-384 hash: 760f58f17ac4e6474c47939370a75bd84a4d89f33cf533cea0aaed5a1c6d62d1031af1508134200531b9ceb90d052a77
SHA1 hash: 8b969e643dc749e73c29738bd1dec96f45b7f262
MD5 hash: def4b79222d9b83b69e0b1322a7623d3
humanhash: muppet-lake-edward-queen
File name:dëshmi e pagesës.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:560'279 bytes
First seen:2020-06-17 07:41:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:51+hIG06ULtHk+RXuJMmbEsJkPuiuJUrARS8xMEzzTOfBwZA2+qVY:5YhIYUBdRXGMmheBSUMRSKbOuu2+qW
TLSH 94C4233B23257CDB27133A07C4DB894019653CCB88A1D891BBBDD83BD8F1A91D9975CA
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

From: toafik@goodiesfoodsltd.com
Reply-To: toafik@goodiesfoodsltd.com
Subject: Emailing: DOPIS 028N
Attachment: dëshmi e pagesës.zip (contains "dëshmi e pagesës.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 07:43:04 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5j7x5e2nbl5hmih2s4553yurpulzzudof5idailfepuby5tppqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip bf53fbf49a6857d3b107d4b9deef148be8bce683717a81810b291f40e3b37be0

(this sample)

FormBook

Executable exe 608a80fead8047545beea311f70ac37dcc5c97fceb2961b9cbea9fb6940dc3eb

  
Dropping
MD5 338f4b8ec1f653e46ada681456fbe102
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 608a80fead8047545beea311f70ac37dcc5c97fceb2961b9cbea9fb6940dc3eb

Comments