MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fa7d95ad6cc653b776a04af1abbb05050458bc9ef7ce3ab928d67615f9496c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fa7d95ad6cc653b776a04af1abbb05050458bc9ef7ce3ab928d67615f9496c4
SHA3-384 hash: 4c318dde4e4be9694987cec25a6245b2418c46a9c006c2ef5a484aebdefd64c898033ba2c47eaf528ec0f96d7d3f85c7
SHA1 hash: f9c1e29b9dc7e1c5ff83cb284310c0d0c2f30eeb
MD5 hash: 3f95992db8dfd967a1d1f6851fb086ed
humanhash: avocado-winter-mirror-magnesium
File name:PO-HN210520-01.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:15'365 bytes
First seen:2020-05-21 07:11:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:3Cx73sVPn7URy/1hdUThF3blSXWhjLmKTxe3:3Cxg9n7URamThNgijLm2xk
TLSH 9062D1B864D561A7AE014AE0E7CE7CE7D6827232DD07F9751F07AF650CB70A5129CC60
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic310-25.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.186.206
From: Kim-K. Sally <kimsally@163.com>
Reply-To: kimsally@163.com
Subject: Fw: Please Check New Order Please Send ETD/ETA
Attachment: PO-HN210520-01.rar (contains "PO-HN210520-01.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-PowerShell.Trojan.Cjq
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 07:35:57 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6t5swwwzrstw53kasxrvo5qkbielc6j556ohk4srvtwcx4us3ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 6fa7d95ad6cc653b776a04af1abbb05050458bc9ef7ce3ab928d67615f9496c4

(this sample)

FormBook

Executable exe fbc04306880313e1c67e38265c9ec331f336cba5bc461266e05228b22094defc

  
Dropping
MD5 35459f019b273f9becc7346a5ed43315
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fbc04306880313e1c67e38265c9ec331f336cba5bc461266e05228b22094defc

Comments