MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8905a22150c6b1994c150a19b1f2f2197c226b055aff041efbe40ab586f9cd8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8905a22150c6b1994c150a19b1f2f2197c226b055aff041efbe40ab586f9cd8f
SHA3-384 hash: 3eb45e35182d556d60b1050b3d9ab290d9d4b87665b55b01b4a5dd89099df9eaa90fdcf06d06af157e1497083ac0b6fa
SHA1 hash: df0c14db93a67d7d7bc455f6cfbeac11a87fe97f
MD5 hash: bd38d0fe93fd2e7ab726db2f92aa2f2f
humanhash: pluto-twelve-mobile-nitrogen
File name:Medical supplies Order - FARAM.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:467'353 bytes
First seen:2020-08-31 08:46:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:RfPTpiKi8o21IiugkYaaY/gtzgCqoSyXe:RjpXi8BfuHBa7tzg6SyXe
TLSH 03A4230862CD988DDFD65CCBD127082C597E7C68DCBB6A7DB92E3887018A91531DE387
Reporter abuse_ch
Tags:Endurance FormBook gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-214-233.unifiedlayer.com
Sending IP: 162.241.214.233
From: Customer Service <customerservice@faram-ea.com>
Subject: FARAM - Kenya Medical Supplies Order
Attachment: Medical supplies Order - FARAM.gz (contains "Medical supplies Order - FARAM.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8905a22150c6b1994c150a19b1f2f2197c226b055aff041efbe40ab586f9cd8f/
Threat name:
ByteCode-MSIL.Backdoor.Knockex
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 02:19:20 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rec2eikqy2yzstavbim3d4xsdf6ce2yfll7qihx34qfllbxzzwhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8905a22150c6b1994c150a19b1f2f2197c226b055aff041efbe40ab586f9cd8f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 8905a22150c6b1994c150a19b1f2f2197c226b055aff041efbe40ab586f9cd8f

(this sample)

Formbook

Executable exe b881e52663ba0b4af029f185d0ff8b16c7e77f253df90a489e46b67e44c3c20f

  
Dropping
MD5 b173e31f4ff38cafc13cc4092f5c19fb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b881e52663ba0b4af029f185d0ff8b16c7e77f253df90a489e46b67e44c3c20f

Comments