MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842
SHA3-384 hash: ee162fde43881eb1c352b8fdea698d25372b7cd1b7cb31edbf4a4415ba54ca16701318115f579c54cea251ba10afd184
SHA1 hash: b2daae78d53f08d5bc005ed3f8f613937603bdcd
MD5 hash: 6499b551d3c4cb8967b3d5f6570a5217
humanhash: jupiter-yankee-lima-potato
File name:INQUIRY.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:496'557 bytes
First seen:2020-08-17 08:25:34 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:z6l4Zk1KZdiwKVUrs5v3VEds9x6RmF0TRwVk2Kyxp4N:hZS2NsUyS7UMRuKyQN
TLSH 68B423688E33DA0C331B7BFD8B64A12A9D5E938B30557B6240FF9E161177E481D3C585
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Lizzy Wu <support@haisokbr.go.th>
Subject: Purchase Oder
Attachment: INQUIRY.rar (contains "INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:27:08 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yugrji6lukhpmw2hlaz4qaxivhhfd7hpw4veklmplwvelkl4dbba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar c50d14a3cba28ef65b475833c802e8a9ce51fcefb72a452d8f5daa45a97c1842

(this sample)

FormBook

Executable exe a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028

  
Dropping
MD5 f0c9e48019fa38ed13d89031cd5f2f16
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a09022457c7802a48a3f2ef32b8008da65fb4b28b43c8e6ac37c44f0a3ecc028

Comments