MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3584a1c0b1ef438d154b81c721c2ab035b30b85e1f2d8f3669d50c612c45a9be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3584a1c0b1ef438d154b81c721c2ab035b30b85e1f2d8f3669d50c612c45a9be
SHA3-384 hash: ce8e6bf58048c2234669fe490f3994361dcb34d09b46d6727e9bd12397a485d67486c718d06b31e6eff1e156b3327cb2
SHA1 hash: 417b7f3fe4b7a7c8d0bfa85e764ee4be0b509b17
MD5 hash: 3996ee4307b48c549eefd465749f4b62
humanhash: equal-georgia-apart-pip
File name:DHL reciept.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:561'355 bytes
First seen:2020-08-31 05:55:51 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:d4+7R0mBeF8ZIG8Wd/ol1P0njckZxaCWNwB38LLZTJ:d4+fk08WdolFDkfaVGlCLZTJ
TLSH 07C42377D3FCC82610A14973B9E5531BBBBA11B948F0CE45D038701FBE169871B7AA49
Reporter abuse_ch
Tags:arj DHL FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 99cquerybulk.info
Sending IP: 117.50.2.156
From: DHL<sales@99cquerybulk.info>
Subject: Wrong delivery address
Attachment: DHL reciept.arj (contains "showwww.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3584a1c0b1ef438d154b81c721c2ab035b30b85e1f2d8f3669d50c612c45a9be/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Suspicious
First seen:
2020-08-30 22:17:51 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwckdqfr55by2fklqhdsdqvlanntboc6d4wy6ntj2uggclcfvg7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3584a1c0b1ef438d154b81c721c2ab035b30b85e1f2d8f3669d50c612c45a9be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 3584a1c0b1ef438d154b81c721c2ab035b30b85e1f2d8f3669d50c612c45a9be

(this sample)

FormBook

Executable exe 0de7b2b7c4e9974b9343de9666287a7137614cbcffc5f89932601b503712002a

  
Dropping
MD5 54f587fab874c9b075cc8395bba71b15
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0de7b2b7c4e9974b9343de9666287a7137614cbcffc5f89932601b503712002a

Comments