MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cbd627b8f24785bbe4b22282a973322c4692767b8baa6632439db7101b2f022. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cbd627b8f24785bbe4b22282a973322c4692767b8baa6632439db7101b2f022
SHA3-384 hash: cdf6b490d58b7408234f960316ba976c9e2a1adb30dc403f4e5be025738f0d7b27d111ce390a768095d93af4229494e3
SHA1 hash: defd172f1949b0f1dd30e5599ad05a4690e4b029
MD5 hash: 98705731a7e0808e3e6a2cf0d5fd3f01
humanhash: friend-georgia-colorado-summer
File name:Paymentreceipt.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:677'927 bytes
First seen:2020-12-28 08:01:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Axc4CHp0kJ9ztiL3av8Q5WXSzJ0nboul+/lXRtqgDQtFTaEOKsac7cGWS:Axma81tiIoiVgoS+kgDQtFmEOKshg9S
TLSH F0E42326236BE105E8E7623AD5C90908CA0C2AC75A7D12F9001B5EB763F96E7D5F70DC
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sage.superdnssite.com
Sending IP: 184.154.31.115
From: Stormany Nylens <info@lyresidencesuite.com>
Reply-To: asqhopeland8@gmail.com
Subject: Re: Bookings
Attachment: Paymentreceipt.rar (contains "Details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7cbd627b8f24785bbe4b22282a973322c4692767b8baa6632439db7101b2f022/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 08:02:06 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ps6we64per4fxpsleiucvfztelcgsj3hxc5kmyzehhnxcans6ara._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7cbd627b8f24785bbe4b22282a973322c4692767b8baa6632439db7101b2f022

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 7cbd627b8f24785bbe4b22282a973322c4692767b8baa6632439db7101b2f022

(this sample)

Formbook

Executable exe 616c28fcce50820b53f2e7489697ceec0526c0e6005c25c4a2f312b2cc8822a3

  
Dropping
MD5 d3201c40a0a06d8d344f6c24258cfa3e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 616c28fcce50820b53f2e7489697ceec0526c0e6005c25c4a2f312b2cc8822a3

Comments