MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f839e0698ba56e6cc35b48db7c13c5863256c6464cc94cec81e21892d6170934. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f839e0698ba56e6cc35b48db7c13c5863256c6464cc94cec81e21892d6170934
SHA3-384 hash: 8aea18cd1c61e7c8bda10df3586596317c638c06a9d423a361ac293fad89a3247874ad3596bbe124b8ff92a972e68cbd
SHA1 hash: a7fc33cc0907917b5df4598135f15b61f6980abd
MD5 hash: 800b7b43847d6e86168a16e3b36e0089
humanhash: indigo-coffee-september-beryllium
File name:ZHANG 2109374.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:426'564 bytes
First seen:2020-08-08 08:17:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:82qLBpUjPKvuIn4vM17i0wmpNLIEIdTEqTpVBCZk8:ALgOuI4vM17i0weL9QpVBCi8
TLSH 2F94233E2C78C95734F0B005C5935B674AA92DADA9E90BD1ABF5048FDE204BF34B7880
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic307-2.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.134.41
From: wellam test-user <t_wellam2@yahoo.com>
Reply-To: t_wellam2@yahoo.com
Subject: HELLO
Attachment: ZHANG 2109374.rar (contains "ZHANG 2109374.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f839e0698ba56e6cc35b48db7c13c5863256c6464cc94cec81e21892d6170934/
Threat name:
Win32.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-08 08:19:05 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7a46a2mluvxgzq23jdnxye6fqyzfnrsgjteuz3eb4imjfvqxbe2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f839e0698ba56e6cc35b48db7c13c5863256c6464cc94cec81e21892d6170934

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar f839e0698ba56e6cc35b48db7c13c5863256c6464cc94cec81e21892d6170934

(this sample)

FormBook

Executable exe dfb621588ae460ad55e4c5df59560023c7a87327c85f23b6fb9ee322c6488eec

  
Dropping
MD5 0679f7b72bd236baf2532eb18adc2ffc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dfb621588ae460ad55e4c5df59560023c7a87327c85f23b6fb9ee322c6488eec

Comments