MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37f65d5e014785e5485a0e030b4256e946bf2cd6cff7aae59199382346d2daeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37f65d5e014785e5485a0e030b4256e946bf2cd6cff7aae59199382346d2daeb
SHA3-384 hash: f7e62d9535bb65f57be1c2c34015fbfbc765eff18f1e74f145ec77c49c1d696e35c904ee3a640fe7c11af349ab8d78e7
SHA1 hash: 578812a2505147402713372153e5543ccfe97bbf
MD5 hash: 78ad1b79a6335a870b1cf9060480c073
humanhash: two-utah-lactose-queen
File name:KH.O2333#.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-15 11:03:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:7LWkuJp4awqVFQpJR+rLuGXd+NznnFE4XTRZqr:PWkEia7Vipn+rLuGXYNznFEGTRZqr
TLSH 9B4502DBA5EDC5A0D4DC46311D0E76A02E84FC9364070329288DF6ADB3B7B28A4B7775
Reporter abuse_ch
Tags:COVID-19 FormBook img


Avatar
abuse_ch
COVID-19 themed malspam distributing FormBook:

RAR->IMG->EXE

HELO: salo.com
Sending IP: 94.177.240.142
From: Chu Lam Yiu <tskiba@besser.com>
Subject: COVID 19 PENDIMG ORDER
Attachment: KH.O2333.rar (contains "KH.O2333#.img" -> "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheFihaAL.12297.23711.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-04-15 02:14:00 UTC
File Type:
Binary (Archive)
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g73f2xqbi6c6ksc2bybqwqsw5fdl6lgwz732vzmrte4cgrws3lvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 418fc8f93bfeab75d54ea3b9bf1d91292f6aa1f858dfbf95b03dac82b0c1a4b5

Formbook

img 37f65d5e014785e5485a0e030b4256e946bf2cd6cff7aae59199382346d2daeb

(this sample)

Formbook

Executable exe bcd9aa0b18caf74a7d771c9802cdbb4f05a810c29c2d093252f004564fe4ed2b

  
Dropping
MD5 2c1fe24e7b0abe668a26653a8077f9a1
  
Dropping
SHA256 bcd9aa0b18caf74a7d771c9802cdbb4f05a810c29c2d093252f004564fe4ed2b
  
Dropping
FormBook
  
Dropped by
MD5 e4483c7ab0f9beced306226603ecfc08
  
Dropped by
SHA256 418fc8f93bfeab75d54ea3b9bf1d91292f6aa1f858dfbf95b03dac82b0c1a4b5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcd9aa0b18caf74a7d771c9802cdbb4f05a810c29c2d093252f004564fe4ed2b

Comments