MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48d7448ef778c38e74298eb2b64679f7cabf3ead73b61d203bf7e43ce4dd37d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48d7448ef778c38e74298eb2b64679f7cabf3ead73b61d203bf7e43ce4dd37d9
SHA3-384 hash: 712bffdeabc6ea6cc4ed6741c8e52b822fe545d1c57b9d91272d5c292e7b71030d14f3f41975eb9a90941e8584d0caf8
SHA1 hash: 2ddf45f54c627ca34dee28715b320341f61cba1e
MD5 hash: 3a16ab36d062ceec2820e59fcea308db
humanhash: nebraska-carbon-california-seventeen
File name:Transfer form.r15
Download: download sample
Signature Formbook
Create hunting rule
File size:223'718 bytes
First seen:2020-10-27 16:48:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:9DaWW37MGnqeWjcqxrpb00RXtbnrEsLGnCD:9aWW37xq37xrNjXprENnM
TLSH 01242219A87C44EB2CDEE9826B42543E59CBC02FBD87910A3B94E3376E185216C5FDDC
Reporter abuse_ch
Tags:FormBook r15


Avatar
abuse_ch
Malspam distributing Formbook:

From: sales@ultimatecircle.com.my
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: Transfer form.r15 (contains "Transfer form.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48d7448ef778c38e74298eb2b64679f7cabf3ead73b61d203bf7e43ce4dd37d9/
Threat name:
ByteCode-MSIL.Spyware.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 16:10:39 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jdlujdxxpdby45bjr2zlmrtz67fl6pvnoo3b2ib367sdzzg5g7mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48d7448ef778c38e74298eb2b64679f7cabf3ead73b61d203bf7e43ce4dd37d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 48d7448ef778c38e74298eb2b64679f7cabf3ead73b61d203bf7e43ce4dd37d9

(this sample)

Formbook

Executable exe 6308def230fca10ddd70426bb31764afd2564530a7ff775cf28e5e958c5bd37a

  
Dropping
MD5 687c725aba0415ff0e9754acc5734a72
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6308def230fca10ddd70426bb31764afd2564530a7ff775cf28e5e958c5bd37a

Comments