MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 874bcf36a89893b7d6c8eda928d18979f68221cc23618393f569ff2a19b57f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 874bcf36a89893b7d6c8eda928d18979f68221cc23618393f569ff2a19b57f50
SHA3-384 hash: 07c8020b52da1bd419cb623ab4901d956bad31457a6af3e208043d4f922217142c432fa57d171a9a42a9673792fafde4
SHA1 hash: adfa8414a4101aca7973cfd3f51b250a8b33a861
MD5 hash: 63b4e5c12d118d87cca28a8a523764dc
humanhash: carolina-georgia-snake-skylark
File name:New order Urgent.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:501'714 bytes
First seen:2020-06-29 12:44:03 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:BvKtKjr1bGPuJv/ErlxytBGTeX737Et6C3w6/80XPsOIzICCa:ByU3BnJUlxiBG67wt6ZglXbId
TLSH AAB4235C3CE83AF9E742B26FD0E06C4A96B357C613136916C27520FBF9685CA0E7944E
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: nuchangecommbest.live
Sending IP: 106.75.34.211
From: Avner <sales@nuchangecommbest.live>
Subject: New order (Urgent)
Attachment: New order Urgent.arj (contains "New order Urgent.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/874bcf36a89893b7d6c8eda928d18979f68221cc23618393f569ff2a19b57f50/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:45:10 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q5f46nvitcj3pvwi5wusrumjph3ieiomenqyhe7vnh7sugnvp5ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 874bcf36a89893b7d6c8eda928d18979f68221cc23618393f569ff2a19b57f50

(this sample)

Formbook

Executable exe d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835

  
Dropping
MD5 e59ffb70eb66762202523045450a00dd
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835

Comments