MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5db76eb822f53736bd295444dd7fe8ee562bd095be01e0ef4873ef8a9e590254. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5db76eb822f53736bd295444dd7fe8ee562bd095be01e0ef4873ef8a9e590254
SHA3-384 hash: ba5f85c8c8bc71ecf27c33c426725c96e75470f569f8f384f2e33d707ad6ba410a07dc972be1bb4baee4af167c1ebcaa
SHA1 hash: 1ed8b806cb5dad1970b5c9b5dcb7069dcfac7ce4
MD5 hash: 5812c781c9ad0ba9bf72bd4cf7909f6b
humanhash: vegan-cardinal-mexico-south
File name:HS361 dt 22.10.20.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:388'306 bytes
First seen:2020-10-22 16:12:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:T+h7wcDvQHt29usGBo25NhgVCljtZoStS5Aewk3LiP4/x63pyP/6tYgAxxRY2Y:ih7wWQHA2jlmAy3LbUMPTRu
TLSH 058423166CC2E617CBDAB067D20EC831AED592CFCA32E7D1A5AF5716F54881E3C8E015
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: jupiter.flywan.net
Sending IP: 179.50.4.12
From: G Joseph <support@qbasica.com>
Subject: FW: Freight Invoice - TRUE LOGISTICS [P] LTD
Attachment: HS361 dt 22.10.20.zip (contains "HS361 dt 22.10.20.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5db76eb822f53736bd295444dd7fe8ee562bd095be01e0ef4873ef8a9e590254/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-22 10:22:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lw3w5obc6u3tnpjjkrcn277i5zlcxuevxya6b32iopxyvhszajka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5db76eb822f53736bd295444dd7fe8ee562bd095be01e0ef4873ef8a9e590254

(this sample)

Formbook

Executable exe b29f18da9764550d7f358b748e5a398f6cda7c92645b7cb311fe4dae2b492a05

  
Dropping
MD5 829da20fc2e8f70550f085993cc32421
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b29f18da9764550d7f358b748e5a398f6cda7c92645b7cb311fe4dae2b492a05

Comments