MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28dd31813a7c6e54f9eb4ef3c7e7d1c783606e259875929ef3d6960a654b92f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28dd31813a7c6e54f9eb4ef3c7e7d1c783606e259875929ef3d6960a654b92f8
SHA3-384 hash: c3a890d4b1440aa0ee2fc0b4a2263bd59d11d118042fbe31b3c488c42dc666977e7bf48d1de4ec51967a40c77ed80208
SHA1 hash: 2f95d1c72cbb2aad16c092f133e4b51f78acfd1e
MD5 hash: 2dfb5bdb6aedff39ff9229a720cdb267
humanhash: echo-network-floor-yellow
File name:Swift MT-103.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:641'278 bytes
First seen:2020-08-31 10:23:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:2NA0vp9NPyk7LSeO+cSWoX0XmCKFLCXo47AQsIWg+ALQzY8L7di:2m0vp9NLLSAFXfCKIY47nfZ/LQs3
TLSH A0D4238EBB2CD3B56E6F860C0449B8EED067DD5728E1EB0A75D0DB87ADF613210198D4
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ecquerybulk.info
Sending IP: 23.106.223.15
From: Finance Office <sales@ecquerybulk.info>
Subject: Fwd: Swift MT-103 Payment Advise to Proceed
Attachment: Swift MT-103.zip (contains "Swift MT-103.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

PUA.Win.Adware.Webalta-6879873-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader34.29944.17906.10656.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28dd31813a7c6e54f9eb4ef3c7e7d1c783606e259875929ef3d6960a654b92f8/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 04:35:42 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdotdaj2prxfj6plj3z4pz6ry6bwa3rftb2zfhxt22lauzklsl4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28dd31813a7c6e54f9eb4ef3c7e7d1c783606e259875929ef3d6960a654b92f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 28dd31813a7c6e54f9eb4ef3c7e7d1c783606e259875929ef3d6960a654b92f8

(this sample)

FormBook

Executable exe f5fdaaa92c4b2a31955e4a21469d2562c2b4be7fb1eae2cd06b5bce77dd25b5e

  
Dropping
MD5 c8b18ed72f85f2254d1621c4aea2b0fe
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5fdaaa92c4b2a31955e4a21469d2562c2b4be7fb1eae2cd06b5bce77dd25b5e

Comments