MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3be7d2aa2bd9e5274e09443dd2f692862487fd3aef4b4b5682152a5bc2f6b27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3be7d2aa2bd9e5274e09443dd2f692862487fd3aef4b4b5682152a5bc2f6b27
SHA3-384 hash: f9fb4520a38a785c168de164c704be6b4370aa67c678fd8cb9cf6667d7a99d5d02dab2b0e2d9a2223b2534b3a1f2fcc6
SHA1 hash: af2def29a5be81fe164181428715ffbbae4a3f3d
MD5 hash: ed984fbf0e411c9c3e697d88ac93b0b0
humanhash: wolfram-virginia-texas-idaho
File name:Bank Swift TT copy.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:598'930 bytes
First seen:2020-10-23 06:46:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FS8E9o5TzcfKB20vpriEdt1lRgLYVkT6eVv33RxDvugF+FZ12F31m:hEcwfbYpr3y25yvHTjPYZ1YI
TLSH FDD423D88882F9A70D42921DBA9FDE14CCD47A6DFE699244FC9112F47031FEE167A350
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ohsaccountingservices.com
Sending IP: 103.125.191.170
From: Global Payments<harif@ohsaccountingservices.com>
Subject: RE: SBank Swift TT copy
Attachment: Bank Swift TT copy.rar (contains "Bank Swift TT copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3be7d2aa2bd9e5274e09443dd2f692862487fd3aef4b4b5682152a5bc2f6b27/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 01:46:14 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yo7h2kvcxwpfe5hasrb52l3jfbreq76tv32ljnliefjklpbpnmtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c3be7d2aa2bd9e5274e09443dd2f692862487fd3aef4b4b5682152a5bc2f6b27

(this sample)

Formbook

Executable exe 51fc4c13e2fa607113d821aaab2ba2e96d10097d69698ec3facc71b8b751e068

  
Dropping
MD5 750573c0d279954b21170cd2e060002e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 51fc4c13e2fa607113d821aaab2ba2e96d10097d69698ec3facc71b8b751e068

Comments