MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8aa3b3b7c11bd7bd7be7b35547c7e2ce36768e2d2265bb7673c7a9a272c7960. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8aa3b3b7c11bd7bd7be7b35547c7e2ce36768e2d2265bb7673c7a9a272c7960
SHA3-384 hash: 26615b94c3f39d89d8cce1cf46c98ead7106feb00df5274f3ce18fc32ae1221b1f6b81ec3dda4ef6b95b38aa411b5c41
SHA1 hash: 05704a1d9eef6c443e3e5d66025a876c4667f3f2
MD5 hash: 0636cce6276789754bd5da52e64b2dbf
humanhash: oven-high-black-oven
File name:BANK DETAILS IBAN GB63BUK.r09
Download: download sample
Signature Formbook
Create hunting rule
File size:376'156 bytes
First seen:2022-01-31 09:30:46 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:g162CXTVMuSWZE1lobADcjeGGa8PS3HARmNMhwKkeqkieXoZyZsKGAewX/76H:gU2CX8qbAAjeGT863A35kUi509BuH
TLSH T1DC8423C75F2242356E9AD11B8972917C782DB78EE0E41526371BF2EADFD321106E9C32
Reporter cocaman
Tags:FormBook r09


Avatar
cocaman
Malicious email (T1566.001)
From: "Sefa <sales@marinasofa.com.my>" (likely spoofed)
Received: "from marinasofa.com.my (unknown [45.137.22.35]) "
Date: "31 Jan 2022 09:42:11 +0100"
Subject: "Re: OUTSTANDING PAYMENT// CALLING EXPENSES REMITTANCE/BANK DETAILS"
Attachment: "BANK DETAILS IBAN GB63BUK.r09"

Intelligence

File Origin
# of uploads :
1
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/61f7ac5cd7fd65ae55fbc145/reports/3985163a-5e2c-4bec-86fc-4f18f12a6311/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8aa3b3b7c11bd7bd7be7b35547c7e2ce36768e2d2265bb7673c7a9a272c7960/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2022-01-31 07:37:43 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
5 of 43 (11.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcvdwo34cg6xxv56pm2vi7d6ftrwo2hc2itfxn3hhr5jujzmpfqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/a8aa3b3b7c11bd7bd7be7b35547c7e2ce36768e2d2265bb7673c7a9a272c7960

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r09 a8aa3b3b7c11bd7bd7be7b35547c7e2ce36768e2d2265bb7673c7a9a272c7960

(this sample)

Formbook

Executable exe 5fa95a2623ad47a5b74d6fdc6f3f95b976af3e8a8a40838c5a5acfc9549e8add

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5fa95a2623ad47a5b74d6fdc6f3f95b976af3e8a8a40838c5a5acfc9549e8add
  
Dropping
Formbook

Comments