MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 465b25a48d5c69cb85dd1bf7c749e7a443848aef1d69cf3773188b5a36989373. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 465b25a48d5c69cb85dd1bf7c749e7a443848aef1d69cf3773188b5a36989373
SHA3-384 hash: 4f137210d9b8d2ac977bce3ebd5436155a3268afe143fdb4824ff2f1b9278c2de4c6c138c02075e89c5a20ce816ae448
SHA1 hash: c676c118c6d7d6704c316865b986906f5d5f87d9
MD5 hash: 1fac7db397fb7f77ccfad9a4695176d2
humanhash: violet-lima-cup-white
File name:documents for July consumptions.r00
Download: download sample
Signature FormBook
Create hunting rule
File size:351'174 bytes
First seen:2020-08-05 07:59:13 UTC
Last seen:2020-08-12 10:07:06 UTC
File type: r00
MIME type:application/x-rar
ssdeep 6144:jitHUqjyGOQ9k7wpbabNnOHhVjUobAeavA71GynSIKg1ImS92K+010SDqW7ocOZO:jyHSGOXs24MoqA71/nSIKga92KaDW7oW
TLSH C6742364997F0E2C94988D951C596CAEDF70CF3E7358A0F3D8E893C2DB1E969B4C8640
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: enemomni.com
Sending IP: 103.133.106.216
From: Nipen Das <oceanexport.sage@enemomni.com>
Subject: July Consumption
Attachment: documents for July consumptions.r00 (contains "documents for July consumptions.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200805-0857.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/465b25a48d5c69cb85dd1bf7c749e7a443848aef1d69cf3773188b5a36989373/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 01:32:30 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iznsljenlru4xbo5dp34osphurbyjcxpdvu46n3tdcfvunuysnzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/465b25a48d5c69cb85dd1bf7c749e7a443848aef1d69cf3773188b5a36989373

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r00 465b25a48d5c69cb85dd1bf7c749e7a443848aef1d69cf3773188b5a36989373

(this sample)

FormBook

Executable exe dda62be10b5d6c904c056f244d721e7dfc5bd60d033992a4763fb1105e0c334f

  
Dropping
MD5 2791efe4baf745bb5ead83f0099fc9e5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dda62be10b5d6c904c056f244d721e7dfc5bd60d033992a4763fb1105e0c334f

Comments