MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee5ab59e924592f9db91c2fd201f13eb426de234ac78c854071ffb7bc7f1aa77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee5ab59e924592f9db91c2fd201f13eb426de234ac78c854071ffb7bc7f1aa77
SHA3-384 hash: 091771144991ee5b1ee9d8c69b2afc02996a6c6928284cac51e9ed476095cde04700a4c74c431fc1f37a3488fa24cc24
SHA1 hash: 51cd02a06fd1d38e19801e93be2ce3ecc9850a27
MD5 hash: 799c73ce6fc7a04beb2a16cb34df628d
humanhash: cat-potato-pluto-kitten
File name:rectified quote.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:264'620 bytes
First seen:2020-07-13 14:17:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XAxRq7ZZpLrtKjreYbHtzPpnV+fF4MEsskKn/eKv1K:C4tLLrtKvPppV22MEsskKnv1K
TLSH 564423D10E67066ACE2CF0850C9981981BB5444BED9E86F43C49CF27FB47AD8BC949B7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ngmontajes.com
Sending IP: 95.211.253.194
From: 'admin' <admin@ngmontajes.com>
Subject: Re: rectified quote
Attachment: rectified quote.zip (contains "rectified quote.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WOU.19723.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee5ab59e924592f9db91c2fd201f13eb426de234ac78c854071ffb7bc7f1aa77/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 14:19:04 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5znllhusiwjptw4ryl6sahyt5nbg3yruvr4mqvahd75xxr7rvj3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip ee5ab59e924592f9db91c2fd201f13eb426de234ac78c854071ffb7bc7f1aa77

(this sample)

FormBook

Executable exe 714e525a436fc97ce8b8e31b63c79e8f13cc0577c80f613f825cafdf7fddeb1f

  
Dropping
MD5 0c6982e8d622d6550a6a170f1c0b9c49
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 714e525a436fc97ce8b8e31b63c79e8f13cc0577c80f613f825cafdf7fddeb1f

Comments