MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51c527e345c4efc5285eef1ad86a197591e62562f0af5ef583ced4b073ba4965. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51c527e345c4efc5285eef1ad86a197591e62562f0af5ef583ced4b073ba4965
SHA3-384 hash: 0aec45c705b8da10c6d14f080b0d739e0d58f342817200d332845410dee4e9462a8678d6e306ac2dcdf2233d6a30591b
SHA1 hash: faf211032c3e4a71e7aa6148fc7f349c0f090e5f
MD5 hash: a519785bea2a349f5ce5faa5f94ada98
humanhash: xray-high-shade-social
File name:AWB 67389928.z
Download: download sample
Signature FormBook
Create hunting rule
File size:230'467 bytes
First seen:2020-05-20 08:37:34 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:qoL6rqyKOvEcAOpgh/z92plfMmdKVDLY0Ozji90zu:qpXmh/z6M4KVDLy69f
TLSH 2B342232E4FF2AF98ABE6F7C81C66C3A042ACD64191A3D8913518E3BFBD1C91523455C
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: gongcha.com
Sending IP: 80.85.157.91
From: Kirschstein Jorge <jorge.kirschstein@dhl.com>
Subject: Shipment Notification - (AWB 67389928)
Attachment: AWB 67389928.z (contains "AWB 67389928.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 09:36:06 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
16 of 30 (53.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=khcspy2fytx4kkc654nnq2qzowi6mjlc6cxv55mdz3kla452jfsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

z 51c527e345c4efc5285eef1ad86a197591e62562f0af5ef583ced4b073ba4965

(this sample)

FormBook

Executable exe 12cb6d99b66fe413685b633d1238a5695aa8dc77489bb8ab23f8dd15012a0653

  
Dropping
MD5 f2816593f003ffcf7e85a03fa42feab8
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 12cb6d99b66fe413685b633d1238a5695aa8dc77489bb8ab23f8dd15012a0653

Comments