MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c28d886a67cb4cbc6565f97af60126e688b7eba2465a572fbcb7318b588dd5d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c28d886a67cb4cbc6565f97af60126e688b7eba2465a572fbcb7318b588dd5d3
SHA3-384 hash: 8f0af73a62a9002b705aec7b5c7977d05a93218ec537c77dd9723e934820e9e5eb75af78ffd279a71fe80055e61537f5
SHA1 hash: 8e3a8efd3981df185a47bd0c8c4ee2f32861e067
MD5 hash: 5ab021a7622b9a816a09dbd5f634708c
humanhash: washington-purple-batman-illinois
File name:Alpha Bank e-statements.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:406'692 bytes
First seen:2021-01-19 15:03:37 UTC
Last seen:2021-01-19 15:04:48 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:0wWCGZiZ9qe6M88pBL7QHfXKkLEsKodUOhSFBlCIpeRjSP+2JDgUbEuo:0N6v64LUHff+yUOkFy2eRmG2VghL
TLSH 5D84234C81A7951B73C2869E3E3B7B0C6F515CB62C3566B6904B474B86C2FACD237394
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Alpha Bank <e-statements@alpha.gr>" (likely spoofed)
Received: "from postfix-inbound-2.inbound.mailchannels.net (inbound-egress-6.mailchannels.net [199.10.31.238]) "
Date: "Tue, 19 Jan 2021 05:07:03 -0800"
Subject: "Alpha Bank e-statements"
Attachment: "Alpha Bank e-statements.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c28d886a67cb4cbc6565f97af60126e688b7eba2465a572fbcb7318b588dd5d3/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 15:04:06 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
10 of 46 (21.74%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c28d886a67cb4cbc6565f97af60126e688b7eba2465a572fbcb7318b588dd5d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c28d886a67cb4cbc6565f97af60126e688b7eba2465a572fbcb7318b588dd5d3

(this sample)

Formbook

Executable exe ca035ce2804aff96e07142ecb344766e2fca568af3b5b01f60d7886225d7cd49

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca035ce2804aff96e07142ecb344766e2fca568af3b5b01f60d7886225d7cd49
  
Dropping
SHA256 449e62f0a80a15ae14d16333c553cc9900edb7f282626988beaad31eb5147700

Comments