MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e3dc19e5b08d403659c43bced3621de39782e777b8fdca764218b793f030404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e3dc19e5b08d403659c43bced3621de39782e777b8fdca764218b793f030404
SHA3-384 hash: 80b725b9f4ad6c96ad8e96ea9e5b4b5b75d32c5d7a7061acc0e8f01b23d999c7ac749105cfc39dc4f0d4991537abf131
SHA1 hash: 9710dff92f247f6fd8904d5124df9ef40f05415d
MD5 hash: 2c56509fd26bb6075a62202700b00cde
humanhash: mexico-carpet-nebraska-minnesota
File name:NEW QUOTATION AGREEMENT.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:389'136 bytes
First seen:2020-08-05 08:13:22 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:arTqMLO5KcgfJUBBEbeA2Sm5fxAbpoj92+wbhfVXe28UBvEc+QVTakXzXu:cFLIbFBoeA23Ra2jFwb/Xe2dBvEc+Qxa
TLSH 67842378D54021BDEB293553483AF990AF263069CBE4E1D2E0E1227E12A139FD755BEC
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: an.antitechap.live
Sending IP: 45.95.171.135
From: (Ms.)Jane Muorn<info@antitechap.live>
Reply-To: <info@antitechap.live>
Subject: NEW QUOTATION & AGREEMENT
Attachment: NEW QUOTATION AGREEMENT.arj (contains "NEW QUOTATION & AGREEMENT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e3dc19e5b08d403659c43bced3621de39782e777b8fdca764218b793f030404/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:02:18 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ny64dhs3bdkagzm4io6o2nrb3y4xqltxpoh5zj3eegfxspydaqca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6e3dc19e5b08d403659c43bced3621de39782e777b8fdca764218b793f030404

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 6e3dc19e5b08d403659c43bced3621de39782e777b8fdca764218b793f030404

(this sample)

FormBook

Executable exe bfd5b7fed44ddcac2f08d101923547f1e034e1bc2a03aaf358c8925870718dd6

  
Dropping
MD5 aec3f3bed4429899973f4e64af480477
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfd5b7fed44ddcac2f08d101923547f1e034e1bc2a03aaf358c8925870718dd6

Comments