MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269
SHA3-384 hash: d0e6f071bf8e0f208ef74c4931eb1205a185506cff863c27ad2a4ee9d7020cd43002a51a6aee5e712e4dace127d6708f
SHA1 hash: f6911299339b4f1a3e3918e8de285ea09a257292
MD5 hash: 793365b9900fb18919fde92a9fe96ca5
humanhash: fanta-undress-washington-july
File name:032921.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:404'772 bytes
First seen:2021-03-29 06:49:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:gioQz6ha/PvZ5lVJMCqOCQr+1wZFcSsCdcXQk:gio/ha/DJZCQC1w0FXN
TLSH ED8423FFAD0FDC51C14529114B386AB68710A957C39F0AA067F46189B2D92B6FCF2273
Reporter cocaman
Tags:FormBook lzh


Avatar
cocaman
Malicious email (T1566.001)
From: "Account Department <postmaster@iglogi-camo.com>" (likely spoofed)
Received: "from slot0.iglogi-camo.com (unknown [194.31.96.45]) "
Date: "29 Mar 2021 06:48:44 -0700"
Subject: "Fwd: Payment slip"
Attachment: "032921.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 06:49:07 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lk4dra4pfxxvmchszmdhfqzyldfvjh6tz4ihnc2es5w2vdm7ajuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 5ab838838f2def5608f2cb0672c33858cb549fd3cf10768b44976daa8d9f0269

(this sample)

Formbook

Executable exe 02c3598e5f583ac0f0aa5d5c666095d1ab1cd02ebf8d23ad7db61f00da7b793a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 02c3598e5f583ac0f0aa5d5c666095d1ab1cd02ebf8d23ad7db61f00da7b793a
  
Dropping
Formbook

Comments