MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0d4e07d6df63de644f0fcc6fd49199928af1a29992fe924fcc062a67f1ec7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a0d4e07d6df63de644f0fcc6fd49199928af1a29992fe924fcc062a67f1ec7e
SHA3-384 hash: 9d665b628d814d6cbbb673f48521a78cbe514bb6be551505b774c3cc73af45552de377be88422c1705bdbd27dd7d72cc
SHA1 hash: 31b32581cdabde3595af433ccd9e827f2a34d42c
MD5 hash: 3841903ab2d4fcc0b45c31d0541f3a1f
humanhash: robert-hawaii-connecticut-papa
File name:15-8.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:262'733 bytes
First seen:2020-08-15 17:13:40 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:tSCDN/F43sw9UWm5G6ij6e0E/63iHcOeVc/yrq:ICZ/j3Wm5o+eDSiyO
TLSH A44423BE66C8906AB5BC5C0647233C8CEF24DF45BE1379798B8294DC8338DA1BB52534
Reporter abuse_ch
Tags:FormBook Hostwinds HSBC zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: hwsrv-762628.hostwindsdns.com
Sending IP: 104.168.242.143
From: HSBC Advising Service <info@erstisorof.com>
Subject: Payment Advice - Advice Ref:[GLV226611980] / ACH credits / Customer Ref:[LCY571905476] / Second Party Ref:[265452P]
Attachment: 15-8.zip (contains "15-8.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43668756.28410.7869.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a0d4e07d6df63de644f0fcc6fd49199928af1a29992fe924fcc062a67f1ec7e/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Suspicious
First seen:
2020-08-15 17:15:04 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jigu4b6w35r54zcpb7gg7vertgjiv4nctgjp5espzqdcuz7r5r7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a0d4e07d6df63de644f0fcc6fd49199928af1a29992fe924fcc062a67f1ec7e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 4a0d4e07d6df63de644f0fcc6fd49199928af1a29992fe924fcc062a67f1ec7e

(this sample)

Formbook

Executable exe 30bf20d0b592d380864b7ad863e8189d9375ff925d75131221bfdb33a3645199

  
Dropping
MD5 cbe7083550d2ffe9e1dcd7114389b3d2
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 30bf20d0b592d380864b7ad863e8189d9375ff925d75131221bfdb33a3645199

Comments