MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d518ea743cf49538bc0a6c07a35379798237ed4ec112de5681ab1e501584a72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d518ea743cf49538bc0a6c07a35379798237ed4ec112de5681ab1e501584a72
SHA3-384 hash: 0d5b4f91203c46b01cfc7468dd6cc68aacd92ac2563b96aa2ab4769f26ad79a5508b2c0ceb066f76efa1d7bf7db1122b
SHA1 hash: 2973d9c67ece97fee7b70ece9734671e4b479a42
MD5 hash: 3925ae067970bf8755914d5f3caed59e
humanhash: seventeen-seven-ceiling-five
File name:Payment Invoice .arj
Download: download sample
Signature FormBook
Create hunting rule
File size:453'411 bytes
First seen:2020-08-30 06:00:08 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:gETY2Gduu0TBqD4d5zwE4ctAbpxAibzOw1sVI2RF9kdoY9FAJk0vFknB1t:o0TgDQkbOw1AX9kih9vFgBH
TLSH 55A4236A147C0618B39B39C88E956CCC425F3CED0D35526A7EC91F3F742B2621A386F6
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: rabya.com.sa
Sending IP: 23.106.223.212
From: Chief Accountant <abdallah.ajaj@rabya.com.sa>
Subject: Payment Confirmation
Attachment: Payment Invoice .arj (contains "Payment Invoice .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d518ea743cf49538bc0a6c07a35379798237ed4ec112de5681ab1e501584a72/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Suspicious
First seen:
2020-08-29 13:47:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fviy5j2dz5evhc6au3ahunjxs6mcg7wu5qis3zlidky6kakyjjza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2d518ea743cf49538bc0a6c07a35379798237ed4ec112de5681ab1e501584a72

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 2d518ea743cf49538bc0a6c07a35379798237ed4ec112de5681ab1e501584a72

(this sample)

FormBook

Executable exe f44cd8c2df04f8921d2d50831c0268b93d48fb0a149c3783331adaec733a47ed

  
Dropping
MD5 cd420f4d4d30edc17793112524ea0353
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f44cd8c2df04f8921d2d50831c0268b93d48fb0a149c3783331adaec733a47ed

Comments