MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8468e21237246e58c071ddc808765798ca3c4f8d53f537b6f250e8d96271f8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8468e21237246e58c071ddc808765798ca3c4f8d53f537b6f250e8d96271f8d
SHA3-384 hash: 447252183d57e647cd7ffc16a33dc9091ebcaee738d915fed3ccff80e1845f15da4bd11c6963b4206db72ad4542212eb
SHA1 hash: f8bb8259b16a80b0b2ab4587cbf58b2d42f5c16e
MD5 hash: e47ed8cf42774020c73907c8ec89c8b6
humanhash: seventeen-fruit-speaker-vegan
File name:MAPA-WLP-0016 Container list Xlxs .zip
Download: download sample
Signature FormBook
Create hunting rule
File size:431'240 bytes
First seen:2020-05-20 12:31:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:r6C2DaAH1p7ostGjDZGkjhyBWI8NNPVyBvKxmuyeaBCB:r6pP1OstGj4zsVuemuyxC
TLSH 0F9423DCF703D4BFD3811B72627A8FCE085A888B06BDC1E27F9659C765946A4BC484B1
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: postman.capriolo.com
Sending IP: 91.102.231.162
From: Nguyen Tong Thinh <thinhhp@lsvina.com>
Subject: MAPA-WLP- Customs clearance Issue - MAPA-WLP-0016
Attachment: MAPA-WLP-0016 Container list Xlxs .zip (contains "MAPA-WLP-0016 Container list Xlxs .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 12:37:47 UTC
File Type:
Binary (Archive)
Extracted files:
275
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3bdi4ijdojdoldahdxoibb3fpggkhrhy2u7vg63peuhi3frhd6gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip d8468e21237246e58c071ddc808765798ca3c4f8d53f537b6f250e8d96271f8d

(this sample)

FormBook

Executable exe 654e546d40f7d74528c82d0a3feaf917a8a173e07e2a0ad9d5f29fb8b961bc67

  
Dropping
MD5 902f1e577b8aa17d083202c7b7cf4ef8
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 654e546d40f7d74528c82d0a3feaf917a8a173e07e2a0ad9d5f29fb8b961bc67

Comments