MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33b1ceb947efe5ce7ace07a0790c5ff4eaf7f2b0ee78dafdbeee51c7df1322ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33b1ceb947efe5ce7ace07a0790c5ff4eaf7f2b0ee78dafdbeee51c7df1322ce
SHA3-384 hash: 19d2392f019f7185be3280f7fe59dd510275330f0442689e75045d94755412524e98728ab9444b13c7692a74e9460bb9
SHA1 hash: 9c2e0dff2a7e72b3371b7d9e3c0bcf852dbf1721
MD5 hash: 0a7efc3b912f71df3e25b61c35307300
humanhash: lamp-sodium-video-undress
File name:SWIFT DOZNAKA.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:367'571 bytes
First seen:2020-06-06 09:41:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:r7fU0cJSMDFqgJnPUfVKNDA0kDsh0IvhzrBOq8AQ44yQyGNMxohGa0pihf2LSF43:rdcJPFTnMNs5RrQcQ5yQJgo2piQeF3kr
TLSH 7D7423AC8C6A5138D1B377F0CFC663E5468C718A984AC0D7EA651C509384D5C8EE9EAF
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: ns1.monitor.rs
Sending IP: 87.230.87.249
From: timep <timep@timep.hr>
Subject: SWIFT DOZNAKA: ODRI PRINT DOO VALJEVO, val: Rs, Iznos: 1,380.00
Attachment: SWIFT DOZNAKA.zip (contains "SWIFT DOZNAKA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-06-06 09:43:04 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=goy45okh57s446woa6qhsdc76tvpp4vq5z4nv7n65zi4pxytelha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 33b1ceb947efe5ce7ace07a0790c5ff4eaf7f2b0ee78dafdbeee51c7df1322ce

(this sample)

FormBook

Executable exe 85774cdd3163c5e259dafdf67b113fd69fa8f4f9ebd964ee91b099bd2f58ebfd

  
Dropping
MD5 af3108b6d0e79e10bbe7d41569329242
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85774cdd3163c5e259dafdf67b113fd69fa8f4f9ebd964ee91b099bd2f58ebfd

Comments