MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 250ca7dd991b5dd7b63c98901c3d285be7e6eceb6fe6bd556d65632afaafe5fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 250ca7dd991b5dd7b63c98901c3d285be7e6eceb6fe6bd556d65632afaafe5fa
SHA3-384 hash: 5cb9187d8e5926061f0896b8aa465ff37a70a30fad41c5ad28bf07e661c1eec40c78a0b849af0c12e9d212897104e5b2
SHA1 hash: b913a4992189acd1231db24065448c5ff9dee2b2
MD5 hash: 7c29a1a7c6cc0a7c4fa6b58c40d0c2f2
humanhash: hawaii-spaghetti-island-asparagus
File name:SWIFT Payment DOOEL EUR 74,246.41 20210101950848.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:574'896 bytes
First seen:2021-01-19 07:54:38 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ocN/HOU0OppWUaZISRtgrEmKFWrgWfNzs3yn3/oknWtzCMj7:LFHcOpp+ZISRtgrEmKLWVAinvpWFCC
TLSH 81C423F9FAFE36266145FA331DC20BCDC8431DEC6100FC5484F46A8AA9AA7DC616D11D
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

From: International payments department <office@cncautomatizari.ro>
Subject: SWIFT Payment DOOEL EUR 74,246.41 20210101950848
Attachment: SWIFT Payment DOOEL EUR 74,246.41 20210101950848.gz (contains "SWIFT Payment DOOEL EUR 74,246.41 20210101950848.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/250ca7dd991b5dd7b63c98901c3d285be7e6eceb6fe6bd556d65632afaafe5fa/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:55:08 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eugkpxmzdno5pnr4tcibypjilpt6n3hln7tl2vlnmvrsv6vp4x5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/250ca7dd991b5dd7b63c98901c3d285be7e6eceb6fe6bd556d65632afaafe5fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 250ca7dd991b5dd7b63c98901c3d285be7e6eceb6fe6bd556d65632afaafe5fa

(this sample)

Formbook

Executable exe 201f068c15e749ce1d3bd1a8e48909a9b0e8e5b0774b0eb2abc9096449fdbe67

  
Dropping
MD5 b8ead540e40416915bd3f6134f2017bb
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 201f068c15e749ce1d3bd1a8e48909a9b0e8e5b0774b0eb2abc9096449fdbe67

Comments