MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d9513b725fa364654384baafbedb144aba53655794a25da5b93c94aa80bb252. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d9513b725fa364654384baafbedb144aba53655794a25da5b93c94aa80bb252
SHA3-384 hash: d1370daf302b3e2bba1d7bd917bf1cf1ffc50b4730295593753f0712519170a4ce09ed3d6467024b19546c75f1e83589
SHA1 hash: ac5e4c6223449c420d192f74c9e179d6aaba1f83
MD5 hash: 78cb44183417683a86f7b29d2b4783ff
humanhash: seventeen-jupiter-october-arizona
File name:Cona Import Company-RFQ.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:280'917 bytes
First seen:2020-06-24 07:00:54 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gqw8VQpM+CvRMo8mYggepOCBU5vr+njof9RYSVpBx5XRMj400TO:YUaM+yKorlgHPcolZnrX6MPO
TLSH 9454236467C80D3597CB4912655C2F9B6ABCC4FA19C7CE09B07ACBA21128774F7F2C49
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Cona Import Company <csmill@ms27.hinet.net>
Reply-To: csmill@ms27.hinet.net
Subject: RFQ-Cona Import Company
Attachment: Cona Import Company-RFQ.rar (contains "Cona Import Company-RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d9513b725fa364654384baafbedb144aba53655794a25da5b93c94aa80bb252/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 07:02:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lwkrhnzf7i3emvbyjovpx3nrisv2knsvpffclws3speuvkalwjja._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 5d9513b725fa364654384baafbedb144aba53655794a25da5b93c94aa80bb252

(this sample)

FormBook

Executable exe cbd6e5626ae84385a9fc7a7eab1877be367ef0b69dc1c4a8de1f668ecb018ab2

  
Dropping
MD5 9184cac2dd7d6a1163b690681323c4bc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cbd6e5626ae84385a9fc7a7eab1877be367ef0b69dc1c4a8de1f668ecb018ab2

Comments