MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3e14d4ff2f007d535c6be2452053b8d1308b7397a3724ee911a34293fce8125. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3e14d4ff2f007d535c6be2452053b8d1308b7397a3724ee911a34293fce8125
SHA3-384 hash: f5620d2fde504ca696092c2a31691db1bdfc6b25eae2c9feb12aacddba5cff2e92a0f217cff4aa0ad58d4553e1f72d03
SHA1 hash: a0f88352181dc9f2d6ff9a4833eb7098b81d96a0
MD5 hash: 9f0bc4f16c0a07271132cfa4f8f8c728
humanhash: mockingbird-mexico-batman-seventeen
File name:Paymentcopy..arj
Download: download sample
Signature Formbook
Create hunting rule
File size:839'217 bytes
First seen:2020-10-12 05:51:59 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:vWu/Qo9F6bIPW7YbyQqP8UIOpj6pRjJgRSwFHUpmFcX:Ou/QombIypV2Ajs+RRFHUpz
TLSH 8A0533654139B86CCEFEE898488C32D13172B9296A2C31BD0AF7F05672B45D5FF93984
Reporter abuse_ch
Tags:arj FormBook SCB


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.miyoshi.biz
Sending IP: 111.235.136.178
From: Standard Chartered Bank <Account@transfopam.com>
Reply-To: sjrkintluea@gmail.com
Subject: Advice from Standard Chartered Bank
Attachment: Paymentcopy..arj (contains "Paymentcopy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3e14d4ff2f007d535c6be2452053b8d1308b7397a3724ee911a34293fce8125/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 02:03:07 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=upqu2t7s6ad5knogxysfebj3rujqrnzzpi3sj3urdi2csp6oqesq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a3e14d4ff2f007d535c6be2452053b8d1308b7397a3724ee911a34293fce8125

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj a3e14d4ff2f007d535c6be2452053b8d1308b7397a3724ee911a34293fce8125

(this sample)

Formbook

Executable exe f638e03e33b24d736db2873b3dee14d8312731d040adb93265b99e21b94b3978

  
Dropping
MD5 a5da66fd0c48f3d4931c9d7aa4e5bc01
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f638e03e33b24d736db2873b3dee14d8312731d040adb93265b99e21b94b3978

Comments