MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 573da45ead0311437cbb539e9a17f083c6ce62ecebcfb655006d7e052e80646d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 573da45ead0311437cbb539e9a17f083c6ce62ecebcfb655006d7e052e80646d
SHA3-384 hash: 682ddaa832a5d72d16084f577114ec52677b502400492b4c70bf906058cf14d8a32b64837c7c0b88f0d1313b605a1e68
SHA1 hash: 663db8befbc940caaf51146e4dc47a061e4eaffb
MD5 hash: 520b797324eb307753b3871aa4fac2d9
humanhash: juliet-white-failed-pluto
File name:SHIPPING INVOICEpdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:588'843 bytes
First seen:2021-01-06 16:09:58 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:Q/itrXYlnYViagt5LlJMMbJK8jB35qHsNVINyEEjfS7c5Fxtn:4ipIlYY1F3bRjBphVI8EEbS7O/
TLSH 00C4232CAE371C27797EC571DA665630A5AF2135A30DA35384EA87BDF0F330720649E6
Reporter abuse_ch
Tags:DHL FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: elcon-in.com
Sending IP: 185.222.57.189
From: dhl express<Accountant@elcon-in.com>
Subject: DHL BILL OF LADING SHIPPING INVOICE DOCUMENTS
Attachment: SHIPPING INVOICEpdf.z (contains "SHIPPING INVOICEpdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/573da45ead0311437cbb539e9a17f083c6ce62ecebcfb655006d7e052e80646d/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 16:10:10 UTC
AV detection:
12 of 29 (41.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k462ixvnamiug7f3kopjuf7qqpdm4yxm5ph3mvianv7akluamrwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/573da45ead0311437cbb539e9a17f083c6ce62ecebcfb655006d7e052e80646d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 573da45ead0311437cbb539e9a17f083c6ce62ecebcfb655006d7e052e80646d

(this sample)

Formbook

Executable exe 4cab4abfd098f791a77bec161ec5a76ab3b1ef47dc046d9364d48b57065e15e6

  
Dropping
MD5 58cfd059a978b791e714908c0f62f155
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cab4abfd098f791a77bec161ec5a76ab3b1ef47dc046d9364d48b57065e15e6

Comments