MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a
SHA3-384 hash: 587ff4197151563c5cf7e5935fb2cd2ef318c0ba2ebf96279655ac0602e1a50047546e0f04cdc6ad874bf3c0293e3c0e
SHA1 hash: e9c1b24457217f557d74f404e68961d31e8fd91e
MD5 hash: 63cb28e9ac3f5d4dee94967535734822
humanhash: echo-failed-artist-mountain
File name:Sales Invoice no5283.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:426'688 bytes
First seen:2021-04-01 05:44:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tLiVqKVlSkfTXJk8IkjqCtHbL/KF1Fen5ycG6nZRfpNRorOASL111ITsSkUmog:t6GwXJIUqCtH/sFyt6ynSppg
TLSH A89423542C0EBE4BF8AD4AF80E75E1233A0B7019F95DB58E0D1AE4DB6CC212156FDA4D
Reporter cocaman
Tags:FormBook INVOICE rar


Avatar
cocaman
Malicious email (T1566.001)
From: "<aawady@emaarmisr.com>" (likely spoofed)
Received: "from emaarmisr.com (unknown [103.153.183.156]) "
Date: "31 Mar 2021 20:52:15 -0700"
Subject: "Sales Invoice"
Attachment: "Sales Invoice no5283.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-04-01 05:45:07 UTC
File Type:
Binary (Archive)
Extracted files:
50
AV detection:
12 of 44 (27.27%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=txqyf76b3dm7rjrqlzsmcnlkom7jv56vgkzuqrmxmmaoggwklefa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 9de182ffc1d8d9f8a6305e64c1356a733e9af7d532b34845976300e31aca590a

(this sample)

FormBook

Executable exe bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb21e5cc104a482d8d806a79b75f20781bde73dfb3ac59d6cd58fed12e9757e5
  
Dropping
FormBook

Comments