MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4bfa52ee9a80e7d89aaed53260e0c2ac8884f0d403407f195940c316103f1bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4bfa52ee9a80e7d89aaed53260e0c2ac8884f0d403407f195940c316103f1bf
SHA3-384 hash: ed1f6542b8c4779162681d2d51d4b30b580de2d5f10ca633a0caeb1d99f69397a4ac4c3422ce608dee5e56b1240c546a
SHA1 hash: e544ecb15f2e18199b9f4fa02b93de8c04c5f096
MD5 hash: 81de4e33ec70cb2a3ed9f1e4f0e67bf5
humanhash: potato-moon-magnesium-bacon
File name:LKP 1720920 tgl.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:979'807 bytes
First seen:2020-10-20 08:40:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:2HgtXm6AOVGe5Gr+8sOGuZ/Ge6Vyvk3My:2oTA6Z8sObZ/xwMy
TLSH 64253392CBBD70F07CB6A1FC160DF13ADA89A0C591DD31C87011BB48A7EA4A5D992CF5
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cpanel8.wsiph2.com
Sending IP: 110.34.251.21
From: chbai@yw.ac.kr
Subject: FW: PO LKP 1720920 tgl 20/10/20-U
Attachment: LKP 1720920 tgl.zip (contains "LKP 1720920 tgl.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4bfa52ee9a80e7d89aaed53260e0c2ac8884f0d403407f195940c316103f1bf/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Suspicious
First seen:
2020-10-20 00:35:33 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ws72klxjvahh3cnk5vjsmdqmfleiqtynia2ap4mvsqgdcyid6g7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/b4bfa52ee9a80e7d89aaed53260e0c2ac8884f0d403407f195940c316103f1bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b4bfa52ee9a80e7d89aaed53260e0c2ac8884f0d403407f195940c316103f1bf

(this sample)

Formbook

Executable exe b93948ffb4dff372cff177266db421b4e037e63a6db0b611578d592adb2bc79a

  
Dropping
MD5 74fd1412a8366ef32917432e0ce0e33d
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b93948ffb4dff372cff177266db421b4e037e63a6db0b611578d592adb2bc79a

Comments