MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6730578173b0250112c332cd477de1ee393a5ff0d0831b73d5aee905ccfac8a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6730578173b0250112c332cd477de1ee393a5ff0d0831b73d5aee905ccfac8a3
SHA3-384 hash: 2679abee80338f0ed76c6a8f46705ee5da3980976dd38b68c9f60ecbe47c5cd30621bfc625226e0353d88b2a45e8358c
SHA1 hash: d1cee4f482fcd742ef2d9d012b6f392ba8ea5bc0
MD5 hash: 0f7e3faf479cb17029b6a2afbbcb118a
humanhash: iowa-bulldog-nebraska-skylark
File name:5637379-B.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:192'668 bytes
First seen:2021-03-24 16:51:34 UTC
Last seen:2021-03-26 07:27:35 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 3072:Jf1VaH5mpT493EkqCORi+865cAkB40FhNTGdNX24nrv7sm433Xq9TmAX8RZG:JFp093rqC2feBDFC1brzYa7y0
TLSH 481412EBC6944D6FED9DACDDC02086AC6AE78D8E57D1692F34869B17C68C6F00C01279
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
6
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6730578173b0250112c332cd477de1ee393a5ff0d0831b73d5aee905ccfac8a3/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-03-24 16:52:11 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4yfpaltwasqcewdglguo7pb5y4tux7q2cbrw46vv3uqlth2zcrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6730578173b0250112c332cd477de1ee393a5ff0d0831b73d5aee905ccfac8a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 6730578173b0250112c332cd477de1ee393a5ff0d0831b73d5aee905ccfac8a3

(this sample)

Formbook

Executable exe de3c81ef7e59a386f6572d4c095739d45493d90b03c348748200012ec165372f

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de3c81ef7e59a386f6572d4c095739d45493d90b03c348748200012ec165372f
  
Dropping
MD5 b234423dcfffbe4ac21d7cd4f4f1299f

Comments