MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d362676cbff16a9da47bc5f47c66f60e1022286879aa2db74de8f02bcab05ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d362676cbff16a9da47bc5f47c66f60e1022286879aa2db74de8f02bcab05ac
SHA3-384 hash: bcc9039c7fb9e29b83fb953d1bccfee8b038b5b4db2fdd023b8202ba1004d60b3cd6178905f25bca0d05839bc17b0982
SHA1 hash: b479b4ddc074adee14bd8e4c29c997135434a7f8
MD5 hash: 5c3fe229c8ec609000f900ae8a0e0c31
humanhash: magnesium-virginia-cat-network
File name:SwiftMT103_pdf.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:195'606 bytes
First seen:2021-04-06 08:14:51 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 3072:ngiI/5ttmUkweQWF4LRJyO/QIwRJfLl0P8xBiRdrtnm6K7xLDByxBolE74u76g+d:nghWaj58JDllxsFhK7qxBoXuhfnNMJ0A
TLSH B1142384E88293BB28234B2F18EBCE8665EF766519B7D009C198F03C157D276125CF27
Reporter abuse_ch
Tags:arj FormBook SCB


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.hinet.co.id
Sending IP: 116.213.52.215
From: Standard Chartered Bank <mahpuz.m@hinet.co.id>
Subject: SUBJECT:Advice from Standard Chartered Bank
Attachment: SwiftMT103_pdf.arj (contains "SwiftMT103_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d362676cbff16a9da47bc5f47c66f60e1022286879aa2db74de8f02bcab05ac/
Threat name:
Win32.Trojan.ZmutzyPong
Create hunting rule
Status:
Malicious
First seen:
2021-04-05 22:36:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nu3cm5wl74lktwshxrpuprtpmdqqeiugq6nkfw3u32hqfpflawwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d362676cbff16a9da47bc5f47c66f60e1022286879aa2db74de8f02bcab05ac

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 6d362676cbff16a9da47bc5f47c66f60e1022286879aa2db74de8f02bcab05ac

(this sample)

Formbook

Executable exe e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c

  
Dropping
MD5 691c0bfb53b7e5012c0e60de1fe59728
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4938a8244543631ae11deb46e8b4cc3f0a8b8b7c2d4a1246f5bfadb29e0094c

Comments