MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcb50eb4e606d1db5f3438f67dd8f02a0113eda8319e602bbb7dbaec55a28f3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcb50eb4e606d1db5f3438f67dd8f02a0113eda8319e602bbb7dbaec55a28f3c
SHA3-384 hash: 4355ff6ebd7cc8f8abf666c563974a7f196c83671d6181986df66b0263cdee28e425da261872c0c6a8299814249bf260
SHA1 hash: abd505039744cc8e2878cadbe076f4da67f4968d
MD5 hash: 0fb952bd7d74a69ac56acdc0fb4c9b16
humanhash: echo-ten-princess-steak
File name:Purchase Order 77809 for acknowledgment.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:242'538 bytes
First seen:2020-05-13 11:58:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:TM+BoiLfvC9P5xjrpwA1TBGhUpWsjHeJzBWW5QeYgld:jBoiLfvOTjiQGsZ7yBWWqeJld
TLSH 0B34231FBB39D62D99AF36F4BAAD016A501CA1D5D7107628F13D60508810DF6CDD3A3E
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: outriger.biz
Sending IP: 156.96.59.92
From: Kim Sung Hae<sales@outriger.biz>
Reply-To: aoer.wzaoer@gmail.com
Subject: Re: Purchase Order 77809 for acknowledgment
Attachment: Purchase Order 77809 for acknowledgment.zip (contains "Purchase Order 77809 for acknowledgment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Grp
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 12:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3s2q5nhga3i5wxzuhd3h3whqfiarh3niggpgak53pw5oyvncr46a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip dcb50eb4e606d1db5f3438f67dd8f02a0113eda8319e602bbb7dbaec55a28f3c

(this sample)

FormBook

Executable exe b36d0b4952457c89f455f2333a815b0a1d7530a108bf43ea0ef1a7c17fe2774b

  
Dropping
MD5 48884ebe9169015be3e42f68ad14d7be
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b36d0b4952457c89f455f2333a815b0a1d7530a108bf43ea0ef1a7c17fe2774b

Comments