MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a8bc9962270ab81c0cc0b7262248ae3e4dd1956e1baf5563180dfdc58177764. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a8bc9962270ab81c0cc0b7262248ae3e4dd1956e1baf5563180dfdc58177764
SHA3-384 hash: 2e9f8d4d73b29debb13f8e692e29002374791490cadb28fac998b93875c3bd7a6519df7b91a20316e57d19e40793d8a8
SHA1 hash: 8f49b08ade02069f6b213f9239bef34e9f01eaf8
MD5 hash: 7818332e35e8e15cb6805307af2aaf0d
humanhash: summer-harry-missouri-video
File name:Late PO.img
Download: download sample
Signature FormBook
Create hunting rule
File size:745'472 bytes
First seen:2020-08-03 07:18:23 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hSh++sKrgM7bnToEcfMDh+RPbV9ZBIJEm81PI:i+dybnTxdVYbVnBISm8y
TLSH 02F45B523988DC62C2976B32C88F952443B9AD10D9D2DB16B5DEB3EC0222FF7DD055CA
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: wingzooxcin.com
Sending IP: 5.206.224.139
From: Fatima Rahaf <lehnert-verlag@t-online.de>
Subject: Fw:Re:Re: Container shipment order clear PO9844132
Attachment: Late PO.img (contains "Late PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.65384.9240.22405.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a8bc9962270ab81c0cc0b7262248ae3e4dd1956e1baf5563180dfdc58177764/
Threat name:
ByteCode-MSIL.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 07:20:07 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkf4tfrcocvydqgmbnzgejek4psn2gkw4g5pkvrrqdp5ywaxo5sa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7a8bc9962270ab81c0cc0b7262248ae3e4dd1956e1baf5563180dfdc58177764

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 7a8bc9962270ab81c0cc0b7262248ae3e4dd1956e1baf5563180dfdc58177764

(this sample)

FormBook

Executable exe a14dc3eb54f3876b3a2bfc6e0aa105c832fc5424130c43248995cceda6790133

  
Dropping
MD5 3b3ea2b4982bea612fc0cd25cf6398c6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a14dc3eb54f3876b3a2bfc6e0aa105c832fc5424130c43248995cceda6790133

Comments