MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80
SHA3-384 hash: 7dc14d2c65bd3a63ccdb3c356299c466c8225da38d77d6a0966f5765120002dd71bf326f1a0b0febd38781b4319d3caa
SHA1 hash: 35d9c4d59da7708b67b7f4374796ea0ce8306201
MD5 hash: 8f3aca9bda3cb2b6155b8cd275c77063
humanhash: stream-queen-don-jig
File name:booking payments.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:927'714 bytes
First seen:2020-08-19 12:41:13 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:Gq1XX8a0ay0QP68PKcfUUYqw8rllYCBdBrU:GqBW0E6MKI+C9U
TLSH E3153346626540C96EF9613EE1FE8DC9211C38AA30BD3FE67075CAC98782C3D4277D99
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: franceloc-postfix.filnet.fr
Sending IP: 194.187.193.119
From: Cláudia Diniz <info@wip-hausschutz.de>
Reply-To: finance.booking.com@outlook.com
Subject: GROUP CONFIRMATION
Attachment: booking payments.rar (contains "booking payments.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80/
Threat name:
Win32.Backdoor.Blakken
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 12:43:05 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u2v2dwvvew6y4spdmupmsflc3h7zbqj2yyy7vlpa4uq2qkrsp2aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a6aba1dab525bd8e49e3651ec91562d9ff90c13ac631faade0e521a82a327e80

(this sample)

Formbook

Executable exe a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445

  
Dropping
MD5 cd4c0048444fce1f2199415a474fdba8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a943fc4408c2f59f2df0afabf3836e5adae92a8f4a4b1da0270e313d8ea78445

Comments