MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ba439098a991f6c6c177d0ce068d09f6d193a71ba262c32a75e03635e30289b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ba439098a991f6c6c177d0ce068d09f6d193a71ba262c32a75e03635e30289b
SHA3-384 hash: 36f70ead7aed94c2a390f9118c81ea1313333f625e74b6967341018f14987d961c20eb382c3d6f8b7b58ed33f24184bf
SHA1 hash: fc9ff608d3db3f168fda9075ec60f64d1736b01d
MD5 hash: 7f87f7ee0b069e558a6385cf2218abbe
humanhash: kansas-sodium-rugby-fillet
File name:SKM_C221200706052800.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:250'735 bytes
First seen:2021-01-19 12:51:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:f3PIs++/SF124Lsbo15u7lmDP59dWLzFcDKxQTIwqJWSs+:fQkM/Lsc1SKP/ELm2xQTI7MSs+
TLSH F43423037C2F1B5F53D2FB180D605953CAF55408E66540A4813AF98BA93E19CB4BFF56
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.s-giken.co.jp
Sending IP: 140.227.16.105
From: JIRANYA THANAPAT<tearwhite@ever-blue.com>
Reply-To: <t.jiranya@tripetch-isuzu.co.th>
Subject: ST transfer slip
Attachment: SKM_C221200706052800.rar (contains "SKM_C221200706052800n.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Porcupine.MSIL.Kryptik.QME.99421.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ba439098a991f6c6c177d0ce068d09f6d193a71ba262c32a75e03635e30289b/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 03:56:07 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tosdscmktepwy3axpugoa2gqt5wrsotrxitcymvhlybwgxrqfcnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9ba439098a991f6c6c177d0ce068d09f6d193a71ba262c32a75e03635e30289b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 9ba439098a991f6c6c177d0ce068d09f6d193a71ba262c32a75e03635e30289b

(this sample)

Formbook

Executable exe 8bb4cdfefd9caae6291347842048859a0f44a3cd6a3313004506f939541ce0a3

  
Dropping
MD5 428a6aceb56f682b4b95685dd56f805f
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8bb4cdfefd9caae6291347842048859a0f44a3cd6a3313004506f939541ce0a3

Comments