MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5419c9eab428612279f990377a7e6aa3266644773b455c509691b430db1b8d9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5419c9eab428612279f990377a7e6aa3266644773b455c509691b430db1b8d9c
SHA3-384 hash: fdf419e09e6d5e16e53c3e8af466a96b6de91d42238a3f5a006e7a263c96bd01a4aed90dc99fad9474155813b4547bb5
SHA1 hash: 9729fe447b6c57a0b89d19083ba7cab7ef83f864
MD5 hash: a0521b01f914dea91474c45d23af0f3d
humanhash: pluto-vegan-alabama-gee
File name:Swift0125466.Scan.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:571'572 bytes
First seen:2020-10-09 06:33:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:xgWvGVb6RoE3vOhw1IAEDiP6o9Rl56Zx3HOS3FpOi8j:CW46R/Oc3NRl+3uS1pe
TLSH 2FC423BA251AA41F4E1835117A54D91E38373F821CE7286C00093DADAFC697BB9FDEC5
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: tonyhai
Sending IP: 117.121.213.248
From: Moscosso Roberto <euroistru@gmail.com>
Subject: RE:RE:RE:Swift
Attachment: Swift0125466.Scan.pdf.rar (contains "Swift0125466.Scan.pdf..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5419c9eab428612279f990377a7e6aa3266644773b455c509691b430db1b8d9c/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 02:48:17 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqm4t2vufbqse6pzsa3xu7tkumtgmrdxhncvyuewsg2dbwy3rwoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5419c9eab428612279f990377a7e6aa3266644773b455c509691b430db1b8d9c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 5419c9eab428612279f990377a7e6aa3266644773b455c509691b430db1b8d9c

(this sample)

Formbook

Executable exe c61d5fa6c2a4f421767a7c793da96a0e8e88d482e078ef994f0a50bac73464f0

  
Dropping
MD5 9eb463d604de2a45f75435573998efd3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c61d5fa6c2a4f421767a7c793da96a0e8e88d482e078ef994f0a50bac73464f0

Comments