MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3
SHA3-384 hash: f81079edf3d9966495a67ab95747a90881b2209cc1e15680751a48706e9ded136bf877c599b4845b50a21cd887554976
SHA1 hash: 482709e052233323ff6ad80b0342caefe7392593
MD5 hash: b8fd7578234f669cf73f76757103ec25
humanhash: mountain-earth-yankee-one
File name:Swift001.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-30 06:24:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:IAPIpHmX3gQEoaXLa172nOLVZFfjUHh6:PX39G7A7LVZqHh6
TLSH 3B450226B2F58877EA6903B006F77B6AF3F9F646335166133B6C0E5C2B20542EA105DD
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.ivet.bg
Sending IP: 79.98.106.118
From: Miroslav <miroslav.beu@protonmail.com>
Subject: Fwd: potvrzení platby
Attachment: Swift001.img (contains "Swift001_jpg.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen12.61434.9394.20337.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-30 06:15:40 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mppfihdc6t2qfnqi5glyoobspkea7geqvkma4t3ma4hypuzwihrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3

(this sample)

Formbook

Executable exe 04df6344497e9d1c321f32b61df87db549d179c6c66c3bf0b2cc7f6b1510040d

  
Dropping
MD5 ede69ed42c85c61459145bbce2fcb585
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 04df6344497e9d1c321f32b61df87db549d179c6c66c3bf0b2cc7f6b1510040d

Comments