MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f489c4ee22d34ecb260934d0d338a9b19fbd3bcb795a20e7fa4b6ca1c01f8658. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f489c4ee22d34ecb260934d0d338a9b19fbd3bcb795a20e7fa4b6ca1c01f8658
SHA3-384 hash: 41dc0d46972a18707a66f8cddbaa061342e49deddf6ee5409c2fd64094575474767cf8888d86eb052b4cc34f7b325725
SHA1 hash: 35f8bbcca471263db8b92fbfa583ddff366c3ffd
MD5 hash: 65b6418f5fe954554d3198a7c64add5e
humanhash: cat-east-early-louisiana
File name:Invoice.8499490004.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:270'991 bytes
First seen:2020-06-29 06:05:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:LwN8OUEhBhMlQdGNWYsH3KImtSAAU/bDb2C5+OMDCTGKx69sZ:Lw/nhYeHgo8yKx69sZ
TLSH 8644238F7AFD5EA6BFA4515E330FB210244D72E62D11A2C68BFCC17D721122D19B486E
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-742099.hostwindsdns.com
Sending IP: 192.236.162.154
From: stan frost <info@sales02stanfrost.us>
Subject: PI
Attachment: Invoice.8499490004.rar (contains "Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f489c4ee22d34ecb260934d0d338a9b19fbd3bcb795a20e7fa4b6ca1c01f8658/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 06:07:05 UTC
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6se4j3rc2nhmwjqjgtingofjwgp32o6lpfncbz72jnwkdqa7qzma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar f489c4ee22d34ecb260934d0d338a9b19fbd3bcb795a20e7fa4b6ca1c01f8658

(this sample)

FormBook

Executable exe f0013d1d682b7ffb99c5eb489d740a9832cdb4137ca18836a1a87c28726edc23

  
Dropping
MD5 50ebe43247476d04b65853d3ddadfd02
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0013d1d682b7ffb99c5eb489d740a9832cdb4137ca18836a1a87c28726edc23

Comments