MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 657ae6bfa1c2a0ab1db51a4574df99944f4858c9069b575fead21e0b89508c4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 657ae6bfa1c2a0ab1db51a4574df99944f4858c9069b575fead21e0b89508c4f
SHA3-384 hash: 8f46075e7bc2c974d2e3b98638f9807f5609a3a49095d6da1469639e1a2fb97fd6a506d666838a2b6a9d0677e0ab7742
SHA1 hash: fef6517b06adaebffd130a7c6093e2db1a4dc3e0
MD5 hash: 4fe4bc04687ba44a0c700f659a5c92e4
humanhash: cup-fruit-alaska-earth
File name:PO9943441.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:273'333 bytes
First seen:2020-08-17 08:56:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:x5abPs0s4iJIGCv3mUCxW/xgrQuW/g3a2xbuEPETceklV:xGU0WJI93mLUWrPq+hunA/lV
TLSH AE44234D041356B6CD05626005A69D0691B94F74B11AA839FF381788BA3B1233F7FF7B
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.stauboi.com
Sending IP: 45.95.168.229
From: import and export department <orderss@stauboi.com>
Reply-To: import and export department <orderss@stauboi.com>
Subject: order PO#9943441
Attachment: PO9943441.pdf.rar (contains "PO#9943441.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/657ae6bfa1c2a0ab1db51a4574df99944f4858c9069b575fead21e0b89508c4f/
Threat name:
ByteCode-MSIL.Trojan.Fuery
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:57:09 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mv5onp5bykqkwhnvdjcxjx4zsrhuqwgja2nvox7k2ipaxckqrrhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/657ae6bfa1c2a0ab1db51a4574df99944f4858c9069b575fead21e0b89508c4f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 657ae6bfa1c2a0ab1db51a4574df99944f4858c9069b575fead21e0b89508c4f

(this sample)

Formbook

Executable exe 9295ce88660ed117b7cfff0886232a51dc6492bf6100738957bf93fabdb74bb8

  
Dropping
MD5 3c5077999100dd0819114ec2f1611b21
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9295ce88660ed117b7cfff0886232a51dc6492bf6100738957bf93fabdb74bb8

Comments