MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1d1b4d2da6aaaad93a3480579b5bdfb53d877fd891478e3b2ff3eae760246da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1d1b4d2da6aaaad93a3480579b5bdfb53d877fd891478e3b2ff3eae760246da
SHA3-384 hash: a60781f2921ce351ad64d927489181bc8479c83517ce8639e05f622acd862ea0cc70a3ad04cfa346041833fb51b49832
SHA1 hash: b09377a8beb67e978784dc493eb3d6bb644c882e
MD5 hash: 7997d482aadf8404ce2acc792b3fc33a
humanhash: october-winter-april-double
File name:Swift001622.Scan.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:507'829 bytes
First seen:2020-10-16 10:21:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:9yHWmn5gG+dLehbvku7RyiWZQtITj1oPgc4msR:IHWsqGxl8ZiWZ6IHLRmsR
TLSH 87B4338E9BD42469C15C2873543F9FEE81019B1266F43207CC660BB92F2BAEF475F852
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: ajshalom.toservers.com
Sending IP: 190.61.250.150
From: Diego ortega <info@genersia.com.ar>
Subject: Re: Re: MM-953
Attachment: Swift001622.Scan.pdf.rar (contains "Swift001622.Scan.pdf..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1d1b4d2da6aaaad93a3480579b5bdfb53d877fd891478e3b2ff3eae760246da/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 15:57:46 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uhi3juw2nkvk3e5djacxtnn57nj5q575rekhry5s747k45qci3na._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a1d1b4d2da6aaaad93a3480579b5bdfb53d877fd891478e3b2ff3eae760246da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a1d1b4d2da6aaaad93a3480579b5bdfb53d877fd891478e3b2ff3eae760246da

(this sample)

Formbook

Executable exe aa7140aa9e404fcab5e45ba552de89669da4446c6a3474f307def1a75a3d37e0

  
Dropping
MD5 60ece7983b52efb4afcda75e1c7577b3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa7140aa9e404fcab5e45ba552de89669da4446c6a3474f307def1a75a3d37e0

Comments