MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 737a0a98af8680ae43e71664f863147f13473480697767dee2dd0264623d0a90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 737a0a98af8680ae43e71664f863147f13473480697767dee2dd0264623d0a90
SHA3-384 hash: 54c2776a1d822d604c7771f34889ace26590f9eae06e6da143d98efee6aa49e8cbdd766e2e42f9033d9b8b7408eb867a
SHA1 hash: 6a75dce080efe9a41cef7722b5de20e56d3e048b
MD5 hash: 02315370bebb36c0659a66a435b04e0a
humanhash: nineteen-chicken-five-nineteen
File name:유티아이테크-발주서 송부의건..gz
Download: download sample
Signature Formbook
Create hunting rule
File size:457'314 bytes
First seen:2020-10-26 10:09:51 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ib21NkYLQXNUIGQmPqkG3fU+HrhUKNLZIB:Z1NPLuNUI6PLG3fjlNQ
TLSH BAA423A0735EC16C5CEF2E766E60E71DCEFA5B09C20B48522A7B83026363A535E4E543
Reporter abuse_ch
Tags:FormBook geo gz KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm46.hanmail.net
Sending IP: 203.133.180.234
From: UTITECH <wine1072@hanmail.net>
Subject: 유티아이테크-발주서 송부의건
Attachment: 유티아이테크-발주서 송부의건..gz (contains "유티아이테크-발주서 송부의건..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/737a0a98af8680ae43e71664f863147f13473480697767dee2dd0264623d0a90/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-10-25 23:19:02 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=on5avgfpq2ak4q7hczspqyyup4juoneanf3wpxxc3ubgiyr5bkia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 737a0a98af8680ae43e71664f863147f13473480697767dee2dd0264623d0a90

(this sample)

Formbook

Executable exe bb07625dfa5d6a83097fe8ca97e3b03973086c48f05d0a4af05317ec4ad99449

  
Dropping
MD5 a2a428b257a59105a86bac5863d95a5b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb07625dfa5d6a83097fe8ca97e3b03973086c48f05d0a4af05317ec4ad99449

Comments