MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3f0628f7c91717ad0ec7a8829c8892c1eebc1c06464a1e5f670f04eccffe436. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3f0628f7c91717ad0ec7a8829c8892c1eebc1c06464a1e5f670f04eccffe436
SHA3-384 hash: f7467efb4a213e57999e3f649fe0d6af1ea1071e2aa8812fe617ae5f4fda5357dd4bc5443498a703340fe98f49068f11
SHA1 hash: 1174c3592bf5f8b5d0c461c0612e25d8dcd80df0
MD5 hash: 7d3c5ce00a19c4e08d8007315f53dcd3
humanhash: cola-mike-pizza-tango
File name:Purchase Order copy.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:561'641 bytes
First seen:2020-07-20 12:16:35 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:pNP1PYjACG18JcwU9Kt5qeucIPgmnkdpVBAr3pD4OO4hlh1BH0q7BlQzGdT+NG:pMxGCJcwmKtfz4j+LAr30+VBxBuyH
TLSH 16C4236EA40D87D2B5405B3BDE0A15EE736FC46C9D87E390DC792B1349078B4CE868AD
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qamail.clariti.app
Sending IP: 18.235.15.241
From: Joakim Kim <test1@qamail.clariti.app>
Subject: Re: Purchase Order PO-4093021b
Attachment: Purchase Order copy.gz (contains "Purchase Order copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3f0628f7c91717ad0ec7a8829c8892c1eebc1c06464a1e5f670f04eccffe436/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 12:18:08 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pygfd34sfyxvuhmpkectsejfqpoxqoamrskdzpwodye5th74q3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/d3f0628f7c91717ad0ec7a8829c8892c1eebc1c06464a1e5f670f04eccffe436

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz d3f0628f7c91717ad0ec7a8829c8892c1eebc1c06464a1e5f670f04eccffe436

(this sample)

FormBook

Executable exe c2d515e9dd5705196004ff3a32c774ac254b80d3fe97d6d8619c0468ef6ecabf

  
Dropping
MD5 575000e87555c60bdf032dcf7146d802
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2d515e9dd5705196004ff3a32c774ac254b80d3fe97d6d8619c0468ef6ecabf

Comments