MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a455190c2d17d464969979dc2c967212c085021968853622fb1a410b72a1877f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a455190c2d17d464969979dc2c967212c085021968853622fb1a410b72a1877f
SHA3-384 hash: 0a4df9f0bfde8f187c6b26526a524e5d31fa7812d7ea0c545a3bdf69544b5391791854e62459953ce1ccd2a311da3789
SHA1 hash: 800e23e88585a0c035bc19c3a923b0af05aa96a4
MD5 hash: e4d197cb65dffada8be7b555ac351234
humanhash: jupiter-kentucky-oregon-magnesium
File name:CN No 1005911246.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:499'562 bytes
First seen:2021-03-14 06:37:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:WekcKZO/bOPXsSTQaYw3bOlo9gXDx8QPrL/E:WekcAKwsUzYwrOlHO/
TLSH 21B4232CAE25DA35B49134F68FE9259B53A3736078809F102F8A5EF360E4555F7A8CC2
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Mandeep Kalita "<wladimir_alexi@maground.com>" (likely spoofed)
Received: "from [203.159.80.7] (unknown [203.159.80.7]) "
Date: "14 Mar 2021 02:27:59 +0100"
Subject: "RE: Regarding CN No 1005911246"
Attachment: "CN No 1005911246.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a455190c2d17d464969979dc2c967212c085021968853622fb1a410b72a1877f/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-13 23:14:51 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=urkrsdbnc7kgjfuzphoczftsclaikaqzncctmix3djaqw4vbq57q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a455190c2d17d464969979dc2c967212c085021968853622fb1a410b72a1877f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar a455190c2d17d464969979dc2c967212c085021968853622fb1a410b72a1877f

(this sample)

FormBook

Executable exe 7e0c1f10cfd225b16e83ecf7bc37a782441b8a96225fff827572bc3a81421bb9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e0c1f10cfd225b16e83ecf7bc37a782441b8a96225fff827572bc3a81421bb9
  
Dropping
FormBook

Comments