MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb015883a3ca690ae7b5e83b0b0fc9bb1b1957b1af36417cd98bde4778c4adf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb015883a3ca690ae7b5e83b0b0fc9bb1b1957b1af36417cd98bde4778c4adf5
SHA3-384 hash: f7ac0089754e84afe40a85b2547bedd33e58a3b66dd55c1ad9085065138f31d0a9e34f211ceed6576f86713d6081aa10
SHA1 hash: d49fb26a47671be306e1afd54cd165d6c3cf3680
MD5 hash: 19822c0045b010d205b38b77d9108d33
humanhash: bulldog-winter-equal-dakota
File name:Payslip.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:206'644 bytes
First seen:2020-08-05 08:09:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:IHorY/uhbxKjd0uWnXokaLko+ggKPTEeLxBKvT8:1rBhbxKjKtXRaLko+gp508
TLSH C4141228621CFE7059D1927A5F476706FCA62A41248BBACCD2FDE1005FD2D6CAE24C5B
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server0.ihswt.com
Sending IP: 142.11.236.209
From: Per Te Corporation <sales@ihswt.com>
Subject: Payment Advice
Attachment: Payslip.rar (contains "Payslip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb015883a3ca690ae7b5e83b0b0fc9bb1b1957b1af36417cd98bde4778c4adf5/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-05 08:11:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmavra5dzjuqvz5v5a5qwd6jxmnrsv5rv43ec7gzrppeo6gevx2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb015883a3ca690ae7b5e83b0b0fc9bb1b1957b1af36417cd98bde4778c4adf5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar cb015883a3ca690ae7b5e83b0b0fc9bb1b1957b1af36417cd98bde4778c4adf5

(this sample)

Formbook

Executable exe 9a3f18b05ce5e0ad884dc95af226f584d483a91dd15cb895a0cce8b91fb2b314

  
Dropping
MD5 8878c56998671463be540aae4a2a321a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a3f18b05ce5e0ad884dc95af226f584d483a91dd15cb895a0cce8b91fb2b314

Comments