MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3d1d7e60cb95384741048fb8fcf75f9b38040f6068a642dcffaa9389468982a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3d1d7e60cb95384741048fb8fcf75f9b38040f6068a642dcffaa9389468982a
SHA3-384 hash: a0a269efe15c483834a10c4c731f637c369161fbea60d2f890e5da0218a6db8bc698a30773bb0caf7a02246e00dd1911
SHA1 hash: f255784e8e2665151cdb344cd95b65755ccd5ac6
MD5 hash: adc50ce15c2d46bd419cc83e46625bcb
humanhash: delaware-bulldog-equal-vegan
File name:Lists.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:259'034 bytes
First seen:2020-06-02 11:10:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:T4PJcahijVHFI9wlO2Cb9KuOstmCg0Zlfoty2v0xZGvc5Pp:EOahWHF+UCb99tf3rotyCy5Pp
TLSH BC44238C626D618996BB33D799DC2A2F8A1045F8932B110B73D19D37CF5723A2DB1C17
Reporter abuse_ch
Tags:FormBook GuLoader zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: slot0.inspirebuilders.ltd
Sending IP: 5.230.65.156
From: Ibrahim Gokkan <I.Gokkan@vomaxtradingltd.com>
Reply-To: J.opedronov@protonmail.com
Subject: Previous Order - PO-24267
Attachment: Lists.zip (contains "Lists (2).exe")

GuLoader payload URL:
https://drive.google.com/uc?export=download&id=1xd3hCud6T1R4OoZuNBbSfyLm19NEDuBm

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 04:02:36 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpi5pzqmxfjyi5aqjd5y7t3v7gzyaqhwa2fgilop7kutrfditava._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b3d1d7e60cb95384741048fb8fcf75f9b38040f6068a642dcffaa9389468982a

(this sample)

GuLoader

Executable exe 9847005465ae681d1d9533697106492027a1d55b64b0ca1b6f2a79730a5140a4

  
URLhaus
https://urlhaus.abuse.ch/url/374438/
  
Dropping
MD5 2108f351afbc898b6c0855a55275ebb4
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9847005465ae681d1d9533697106492027a1d55b64b0ca1b6f2a79730a5140a4

Comments