MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 909455781c8a185e0665c8bf3c645887218406396f197df33df2f66221129228. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 909455781c8a185e0665c8bf3c645887218406396f197df33df2f66221129228
SHA3-384 hash: 89f4ac569fcf19cacd704859ce8cd714ea230f4553091f37997114fbfc882038f517fb1008ebbd677124fd12330f6f31
SHA1 hash: 814022b2d6251238999a03facd938f59514c0a00
MD5 hash: 287809bf97df5f4ce63f842a09cac6c6
humanhash: wolfram-moon-illinois-spring
File name:New Order.z
Download: download sample
Signature FormBook
Create hunting rule
File size:23'302 bytes
First seen:2020-08-19 09:26:46 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 384:+0NoQgVooNvIPmfH7UBgBE9G36LPP7ICwin/KiM5SXEEY31ED3m+TOV4S477aPLz:+0yQA+PmvQBgB0DjP7xwi/KiM5SXM1EO
TLSH 7FA2E15648D6522A3FE1C1EB509244FF5EB4D98180B2E285F66F4E33C0E9712ACBD7C6
Reporter abuse_ch
Tags:FormBook Hotwinds z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-760084.hostwindsdns.com
Sending IP: 104.168.145.121
From: info@hemoclan.com
Subject: New Order SELINT SRL P.O
Attachment: New Order.z (contains "New Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/909455781c8a185e0665c8bf3c645887218406396f197df33df2f66221129228/
Threat name:
Win32.Infostealer.PonyStealer
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 22:59:51 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sckfk6a4rimf4btfzc7tyzcyq4qyibrzn4mx34z56l3geiissiua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

z 909455781c8a185e0665c8bf3c645887218406396f197df33df2f66221129228

(this sample)

FormBook

Executable exe 9bebd6b8400a02ec36958c8cf06d3abc659b462d482fca3df8a3a64e42b3e234

  
URLhaus
https://urlhaus.abuse.ch/url/435572/
  
Dropping
MD5 0469a27bd0ef6dd387ba38e47614cb6c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9bebd6b8400a02ec36958c8cf06d3abc659b462d482fca3df8a3a64e42b3e234

Comments