MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8edbd6a3f3dba218ac04f3ca1fc7aca552c90d65574313cbf7e5c9a534a55fc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8edbd6a3f3dba218ac04f3ca1fc7aca552c90d65574313cbf7e5c9a534a55fc1
SHA3-384 hash: 1308e962405e8ecea410eaf317aa47d5e46c7cece4cb34257a536cbdf19d0c241383e41b866b26be53472db35d4ed227
SHA1 hash: b7dbd81c1e9589239eb3d4fe17568a3cc59bf165
MD5 hash: 4207e340aeeee4058b6923608130628d
humanhash: potato-equal-enemy-kilo
File name:Bidding of TOE Project Tender.z
Download: download sample
Signature FormBook
Create hunting rule
File size:271'288 bytes
First seen:2020-05-11 08:55:29 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:LikXvkPtlrpf/IDbyiFOEh+7Tge9gL8fehrfRFjFsMMPud18Wt3T0:ZXclrSKkz4MLgfKRd6fGwWt3w
TLSH 5944235DB21E125C778B2D5EAB772697285230DF32E5E82B4AF43D4E680F4102B74E1E
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: coho.com
Sending IP: 217.61.98.69
From: Michael Mereminsky <michael.mer@honeywell.com>
Subject: RE: Bidding of TOE Project (status)
Attachment: Bidding of TOE Project Tender.z (contains "Bidding of TOE Project Tender.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:36:35 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
18 of 31 (58.06%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r3n5ni7t3orbrlae6pfb7r5muvjmsdlfk5brhs7x4xe2knffl7aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

z 8edbd6a3f3dba218ac04f3ca1fc7aca552c90d65574313cbf7e5c9a534a55fc1

(this sample)

FormBook

Executable exe d6330004986cb2968200bad58cb3f1135e2383d9bdf6894feff0f28f952f4c2b

  
Dropping
MD5 c804b7e68edc777cb455860fb17fe28a
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6330004986cb2968200bad58cb3f1135e2383d9bdf6894feff0f28f952f4c2b

Comments