MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50df44784b447c6d531fac4b81bd44359e39ce41cceefc5228003333d705683b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 50df44784b447c6d531fac4b81bd44359e39ce41cceefc5228003333d705683b
SHA3-384 hash: d13fa10fbe91b7abeb618cb8cddce528d523889482cbf4404f72e6bc0856c2fd2fdbdaa565497d7ca39e83a3185bba9d
SHA1 hash: 183933727b083205a6111a7343f0c84f8660fb90
MD5 hash: 2d28e0f0044bb9651edc3df845831a58
humanhash: pasta-undress-one-oven
File name:PRIX4958.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:304'143 bytes
First seen:2020-10-26 15:14:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:9lqr0EHfPc1hQBppU9HKHxzB3Oo2VX4lYd+GoBombcYOy0N:z4Hfk/WvHxYLVX4SS7I/yK
TLSH 95542398A823073B9F959407AC710891FB7553C6229D978E5C93E422438E4BBF237D7B
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: srv20009.hosting.claranet.es
Sending IP: 92.54.18.66
From: commercial <commercial@polycuisines.com>
Reply-To: commercial <info@asguler.com.tr>
Subject: demande offre de prix
Attachment: PRIX4958.zip (contains "RR300912398.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/50df44784b447c6d531fac4b81bd44359e39ce41cceefc5228003333d705683b/
Threat name:
ByteCode-MSIL.Trojan.Shelma
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 12:57:11 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kdpui6clir6g2uy7vrfydpkegwpdttsbztxpyuriaazthvyfna5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 50df44784b447c6d531fac4b81bd44359e39ce41cceefc5228003333d705683b

(this sample)

FormBook

Executable exe 3324b658bb54b1934613b8fdecb2f12f7aabb815a4ca42b48dc7bdf4837026c9

  
Dropping
MD5 6576835f02fd3e5ec9780d5d23126d9c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3324b658bb54b1934613b8fdecb2f12f7aabb815a4ca42b48dc7bdf4837026c9

Comments