MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a32f6503af1e1464b2e59dedf17de562526baba20ef11c31e93f4e27a447ef1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a32f6503af1e1464b2e59dedf17de562526baba20ef11c31e93f4e27a447ef1
SHA3-384 hash: 194db50fc770f8011dbdc6c7f76c44d4c296be46eed35052a66e5e2a366cf121a888204b16637eeb200ce80cc4c8ce62
SHA1 hash: 5bdc382ba9c2f99dc9aee40bfbfc692ac3edc41f
MD5 hash: 7686a5fc6fb98be349a2d1fdb9306301
humanhash: potato-ohio-california-colorado
File name:New Order.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:472'992 bytes
First seen:2020-08-18 12:49:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:NBG5Y2okFbdaJ0+ltzxi+quGh2MLopfb3K+I:NQ508C3xRc2CoJ6X
TLSH 9DA4233130D49886693562031178AA3784A34E6BBCB9E8DEB1CD5FC516AD3415E1FD9C
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Sanda Kozinda <support@haisokbr.go.th>
Subject: Re: Re AW: AW: Order
Attachment: New Order.rar (contains "New Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a32f6503af1e1464b2e59dedf17de562526baba20ef11c31e93f4e27a447ef1/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:51:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jizpmub26hqumszolhpn6f66kyssnov2edxrdqy6sp2oe6sep3yq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4a32f6503af1e1464b2e59dedf17de562526baba20ef11c31e93f4e27a447ef1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 4a32f6503af1e1464b2e59dedf17de562526baba20ef11c31e93f4e27a447ef1

(this sample)

FormBook

Executable exe 700f8405954cf77a38e6b103b33e4c7164202e9126b3b76044be35510b2bf440

  
Dropping
MD5 3bffbc1aae2b94b1b4c6cc406e1d8ff5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 700f8405954cf77a38e6b103b33e4c7164202e9126b3b76044be35510b2bf440

Comments