MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90721d0c5875441a6ec10017e22633eb0147a0437af089e9ca29278d17675b78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 90721d0c5875441a6ec10017e22633eb0147a0437af089e9ca29278d17675b78
SHA3-384 hash: 3bfff8272d74db8d84a3fa11bba0093825c339fb66a57213e2821ec3a7a2b18b46fa870e64223327423d0a69ce9d667a
SHA1 hash: bf3e3d2f44e05ac3e40a120c940cac948a54e517
MD5 hash: 2463ec2f201ab69346ffe019c512d1ba
humanhash: magnesium-one-freddie-bravo
File name:Transfer confirmation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:509'904 bytes
First seen:2021-03-04 10:26:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:yxtXgS/g6sb4jc9REP22AVm73+lD4u8b1bQnumqyyZv1GUatOBCD:ybQ0g6sbSc9AAVm73+yuEFQiyyJ1TQ
TLSH 68B4232D09C811B788396EA715FA07FECBEBC12234A5989F74E3D9108466474B6FF980
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "<customercare@gab.co.ke>" (likely spoofed)
Received: "from [203.159.80.7] (unknown [203.159.80.7]) "
Date: "4 Mar 2021 11:01:01 +0100"
Subject: "Transfer Confirmation"
Attachment: "Transfer confirmation.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/90721d0c5875441a6ec10017e22633eb0147a0437af089e9ca29278d17675b78/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 10:27:08 UTC
File Type:
Binary (Archive)
Extracted files:
64
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbzb2dcyovcbu3wbaal6ejrt5maupicdplyit2okfety2f3hln4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/90721d0c5875441a6ec10017e22633eb0147a0437af089e9ca29278d17675b78

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 90721d0c5875441a6ec10017e22633eb0147a0437af089e9ca29278d17675b78

(this sample)

Formbook

Executable exe b47a61d16376e7b825ec4b7eaa988247644b49ecbe80164b83424a65c014cc05

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b47a61d16376e7b825ec4b7eaa988247644b49ecbe80164b83424a65c014cc05
  
Dropping
Formbook

Comments