MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8386d59d13e0eade159c63fee7a11b074582693f29cdbeacda655df67182595. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8386d59d13e0eade159c63fee7a11b074582693f29cdbeacda655df67182595
SHA3-384 hash: 63f899890cbdf5f21008eebb578d3de267db031cba5e6aea56ed19732be55a3ac4df77a8a11460f2a5b66e7938df0fbf
SHA1 hash: 7ff315d24da1e2f91ded676d254d19823657361e
MD5 hash: ff1f8f379a54a669aadd68939075862d
humanhash: wisconsin-lactose-single-cup
File name:PO2836NZ232.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:656'389 bytes
First seen:2021-01-15 07:16:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:kAtn70fgjqxdAx6xjrY8LrmD3r+jvm76UgZHXoGaz7Oxh:kAt70fOgvU8LrmD3r+K2Rd2Wv
TLSH B5D433F3DA0B07591818ABE025DC3EEF75D0153724B94D8A09AEA1AC1083567F9E937F
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: David Simpson <info@akro-plastic.de>
Reply-To: david@akro-plastic.de
Subject: Re:PO2836#NZ232
Attachment: PO2836NZ232.rar (contains "PO2836#NZ232.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8386d59d13e0eade159c63fee7a11b074582693f29cdbeacda655df67182595/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:17:25 UTC
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xa4g2worhyhk3ykzyy7646qrwb2fqjut6konx2wnuzk56zyyewkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b8386d59d13e0eade159c63fee7a11b074582693f29cdbeacda655df67182595

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar b8386d59d13e0eade159c63fee7a11b074582693f29cdbeacda655df67182595

(this sample)

Formbook

Executable exe 1498cb2f9fa31c5126db058a10187fa76040789d257ac2b61f4d4bbbe77a986c

  
Dropping
MD5 8b9f701b5feeb6d1fc76b9a45ef33695
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1498cb2f9fa31c5126db058a10187fa76040789d257ac2b61f4d4bbbe77a986c

Comments