MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49c9274063562f9da97abda1e47171041589b4a9bf403230883b2576d6358640. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49c9274063562f9da97abda1e47171041589b4a9bf403230883b2576d6358640
SHA3-384 hash: 8a44effe6f16f80a12dc6f7ff583450058732e00ccaa375ef512bab91869146831a93f019419c906f81c7e55e71ccea8
SHA1 hash: 51fad6288e703a791864e335c37f1c7cdcf3f003
MD5 hash: a7e43f7dcca1212caba942b0972f1b16
humanhash: hydrogen-dakota-london-sierra
File name:swiftCopy-20202708index.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:507'894 bytes
First seen:2020-08-28 05:58:43 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:gb3tLGnFkhrF5o0ZYasEasjyzS7+RtU/voj7jftM1xCuRs5:E3NUF4F+0ZJfuuvg3FMf+5
TLSH AAB4234DBA7EBD0EF5162076D73DB4E0A58D41CBBF2A30E0875C301E8B99A51668F835
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

From: <sales@hinet.net>
Reply-To: roadtriip25@gmail.com
Subject: order list
Attachment: swiftCopy-20202708index.arj (contains "swiftCopy-20202708index.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49c9274063562f9da97abda1e47171041589b4a9bf403230883b2576d6358640/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 06:00:10 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jhesoqddkyxz3kl2xwq6i4lraqkytnfjx5ademeihmsxnvrvqzaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/49c9274063562f9da97abda1e47171041589b4a9bf403230883b2576d6358640

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 49c9274063562f9da97abda1e47171041589b4a9bf403230883b2576d6358640

(this sample)

FormBook

Executable exe 74405908a20cd0501916ecf09606e5663e5dfe894ebadd37e5c9bacf66130eea

  
Dropping
MD5 03988eefb2cf4d8a1d8fa3ef19360edc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74405908a20cd0501916ecf09606e5663e5dfe894ebadd37e5c9bacf66130eea

Comments