MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf2cb9bb463a7c669396bef9134fd8a9d6e3aed54bb118cd05f1b4eb009ebcd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf2cb9bb463a7c669396bef9134fd8a9d6e3aed54bb118cd05f1b4eb009ebcd2
SHA3-384 hash: e2525ced1ef710af2d0c517b7039452fc796424f2511e518de39e6dbf9c840ee129efdd7b481cafbb9c9b55760a4de81
SHA1 hash: 077d240a7b7227c0178d232cad10a93a705dc77b
MD5 hash: d27eb8a5d41fc6a548b495589906c3b7
humanhash: winter-kansas-idaho-hawaii
File name:Inv #9098.ace
Download: download sample
Signature FormBook
Create hunting rule
File size:562'373 bytes
First seen:2021-02-08 07:45:22 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:rxBuyBK/KJS7HLf3sd+HAglqv1kX5J0DgOrES6NEHgKbjYBoDYspuc:rxtBGx7r3sEgIikX1cTYggKHGo0s4c
TLSH 1CC423F0D858F1726CF818DE6FAD26BA6CE635F4FC3596C80E22659C27D8A947400CE4
Reporter stoerchl
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf2cb9bb463a7c669396bef9134fd8a9d6e3aed54bb118cd05f1b4eb009ebcd2/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-02-08 01:57:50 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4wlto2ghj6gne4wx34rgt6yvhlohlwvjoyrrtif6g2owae6xtja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf2cb9bb463a7c669396bef9134fd8a9d6e3aed54bb118cd05f1b4eb009ebcd2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

ace bf2cb9bb463a7c669396bef9134fd8a9d6e3aed54bb118cd05f1b4eb009ebcd2

(this sample)

FormBook

Executable exe 12d03b12c58b5cb5509765d70efb25b7f744eb2066a8bb8b71ca69fb2927e854

  
Dropping
SHA256 12d03b12c58b5cb5509765d70efb25b7f744eb2066a8bb8b71ca69fb2927e854
  
Delivery method
Distributed via e-mail attachment

Comments