MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb4c76e46e345870263202cbabf1ec6e82dd4aeb90bb214fdb868e47bb60aff7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb4c76e46e345870263202cbabf1ec6e82dd4aeb90bb214fdb868e47bb60aff7
SHA3-384 hash: 5692a97c309853a694b01caf17ed44f2280a176e36372086906828318c1a2943b05ea54cc197c92062951f5ddf5062bc
SHA1 hash: 69b416a0735fe5b4db21feac5b65f5a3d0867257
MD5 hash: 69797c7f3a34f3447b8125d0eee0815e
humanhash: island-angel-robin-blossom
File name:BL_4050669430 DOC_PDF.IMG
Download: download sample
Signature FormBook
Create hunting rule
File size:1'376'256 bytes
First seen:2020-10-20 07:25:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:b+N0/J2iNli3hZXUbIfPTsF46eqbjbUPVGYM0EJwMEH/4TH+zJalOmGvpCTTqRT9:bzh1ni3hybIfPA+N6Fez
TLSH FF558CAD761072DEC867C9B2CA541C60FBA07877431BE243A06725ADDE5E897DF201F2
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: box.dhlconnext.xyz
Sending IP: 192.236.209.13
From: EPSA EXCAVACIONES MX. S.A. DE C.V. <office@dhlconnext.xyz>
Subject: Re: B/L# 4050669430
Attachment: BL_4050669430 DOC_PDF.IMG (contains "BL_4050669430_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb4c76e46e345870263202cbabf1ec6e82dd4aeb90bb214fdb868e47bb60aff7/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 22:49:16 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=znghnzdogrmhajrsalf2x4pmn2bn2sxlsc5sct63q2hepo3av73q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.91
Link:
https://yomi.yoroi.company/submissions/cb4c76e46e345870263202cbabf1ec6e82dd4aeb90bb214fdb868e47bb60aff7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img cb4c76e46e345870263202cbabf1ec6e82dd4aeb90bb214fdb868e47bb60aff7

(this sample)

FormBook

Executable exe c5219c1f956fe3fd523989a140c35f2ffbcbc7d79218262a29f6a660985175c0

  
Dropping
MD5 97e3d071f835f5b071dc5e1cb72b6113
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5219c1f956fe3fd523989a140c35f2ffbcbc7d79218262a29f6a660985175c0

Comments