🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa770373b30c2f847684241a55b643723a77608f17b9dfd2fcd1e4b875bf2a4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa770373b30c2f847684241a55b643723a77608f17b9dfd2fcd1e4b875bf2a4e
SHA3-384 hash: 950266f4d08f54961a79da78bff21b1bb29baad7c8df05763364c2f001297e6b8d32ce3418a28f32db56c6c16f366dd2
SHA1 hash: a9b179833c94807fee504224a23650df0995af3f
MD5 hash: a63319d8f30cd17c9a6814af1414f882
humanhash: river-california-alabama-three
File name:PO1757611.pdf.cab.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:442'446 bytes
First seen:2020-08-27 08:22:58 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:wBH2HGnd5FSNiFbCLtzHXtWJfOZo/K6mRLdyiOqtKeP7fmojQxCA8teJO:wBH2Q4NiRO3tVbRLwijkeTmSQ/8taO
TLSH 40942340D572FBAFA1BA4F22012B519A4B79CFDEE1383E484B0568A554CFB4F47A314B
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm38.hanmail.net
Sending IP: 203.133.180.226
From: μ£Όμ‹νšŒμ‚¬λ‚΄λ‹΄κ±΄μ„€ <nd505@daum.net>
Subject: κ²¬μ μš”μ²­_ν•΄μ„± _PO1757611.pdf.cab.gz
Attachment: PO1757611.pdf.cab.gz (contains "20200707_PO1757611.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa770373b30c2f847684241a55b643723a77608f17b9dfd2fcd1e4b875bf2a4e/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 08:24:10 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vj3qg45tbqxyi5ueeqnflnsdoi5hoyepc6457ux42hslq5n7fjha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/aa770373b30c2f847684241a55b643723a77608f17b9dfd2fcd1e4b875bf2a4e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz aa770373b30c2f847684241a55b643723a77608f17b9dfd2fcd1e4b875bf2a4e

(this sample)

Formbook

Executable exe bcef7d2e4880300c71e62f7115a3fcf5d4fd3d3a3d8684c1c9a17fd777956e0b

  
Dropping
MD5 d30e459a347f586a09e95332e40901eb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bcef7d2e4880300c71e62f7115a3fcf5d4fd3d3a3d8684c1c9a17fd777956e0b

Comments