MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b09adde7f08d561ddfa1e824d597bf5ad06edb791cb75dca9bd5a9bfecb7748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b09adde7f08d561ddfa1e824d597bf5ad06edb791cb75dca9bd5a9bfecb7748
SHA3-384 hash: 1aa0f1da4bfc0a51ca4aeb11b7221404969e2efe0785a976cc9153818d69b004e5163c7bcd63d7d7ec83fc8c7e56a9c7
SHA1 hash: ececfdd94aebce3ecdf32d0947f6b0d16a7736e7
MD5 hash: 21c4d7e898829bd9ac183f5e81ac3dd1
humanhash: seven-carolina-alanine-three
File name:206731.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:407'099 bytes
First seen:2020-07-13 14:25:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6oxOpZX7jqUmTbWtaIibwAocDtN2DPVrypW:7yZCTbWcIisAocBN2D0pW
TLSH 6E842309D8BAD3847788C2C4E8FD5F439EAFA3D27861ADF616396855C500FE0F916319
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: h3.datagix.com
Sending IP: 82.196.25.97
From: CALIDAD <calidad@pertini.es>
Reply-To: CALIDAD <fayza.hmidi.artlab@gmail.com>
Subject: Transferencia
Attachment: 206731.zip (contains "R010543982.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.LuheMalumA.26452.21905.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b09adde7f08d561ddfa1e824d597bf5ad06edb791cb75dca9bd5a9bfecb7748/
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 14:27:05 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pme23xt7bdkwdxp2d2be2wl36wwqn3nxshfxlxfjxvnjx7wlo5ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 7b09adde7f08d561ddfa1e824d597bf5ad06edb791cb75dca9bd5a9bfecb7748

(this sample)

FormBook

Executable exe cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010

  
Dropping
MD5 d6a9c03b1bbdb0595d8905b80ca73f81
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cd1a9b8d7f8d830bcb13548fdd9f02a7fae07b7c49fd12bd1a7e02ed346bc010

Comments