MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 960eec49178c2263a291d950a88b29b5eab0c743c950368dc0d84df6e49efb5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 960eec49178c2263a291d950a88b29b5eab0c743c950368dc0d84df6e49efb5d
SHA3-384 hash: 18a357970cb2db11d1b0333ab57a9b59d4737d20154e26469c98221864b5dac2e89977ee360024e9d54e5132b7dd21f4
SHA1 hash: 2407c412ce709e9c2c2f1cdc092636fb70f4709d
MD5 hash: e2c43142b7991a2b364dfd5c08cff646
humanhash: uniform-angel-yankee-magazine
File name:Invioice.03000303003.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-11 08:43:22 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:HMLaQcamZYcWeQtoLn4Bebb5pqRi50UYFGZITcJiPY1OkhoKoXPxv359DWYLaOM3:HMLCDblb5pq251ZBWbZ3dLaXU2sG
TLSH 9E45CF05F206806EF748C5BF4826EE604AB02DC670AC70FF36EC75554BB36D35A71A6A
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.befactto.tk
Sending IP: 94.177.240.181
From: Mohamed <info@beermbhde.com>
Subject: Kindly send us best offer for below items with terms and conditions.
Attachment: Invioice.03000303003.img (contains "Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 11:23:04 UTC
File Type:
Binary (Archive)
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=syhoysixrqrghiur3fikrczjwxvlbr2dzfidndoa3bg7nze67noq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 960eec49178c2263a291d950a88b29b5eab0c743c950368dc0d84df6e49efb5d

(this sample)

FormBook

Executable exe 0a19e568f607fdfaa9368dc8b7880b68fa9c41f1de947c31067b7f971ece0d8c

  
Dropping
MD5 3e0d5b5b44e5f31ccdaa1904c951a7a6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a19e568f607fdfaa9368dc8b7880b68fa9c41f1de947c31067b7f971ece0d8c

Comments