MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d51781ac8e03554461d9f410249faa92ee8f67030d58bc508f58d7d254860f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d51781ac8e03554461d9f410249faa92ee8f67030d58bc508f58d7d254860f
SHA3-384 hash: 254e5ae3356a64410383c468fa94f17c5be04799a530b1a523d17e77163c0b73dbfcce8fe9e8d18d02fea18e5725b362
SHA1 hash: 54f3beb2d65fc4d5896860d49eba71c4d460302e
MD5 hash: 9fab3b42038392605846eb50e426a916
humanhash: twenty-arkansas-low-hotel
File name:Revise PI.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:480'679 bytes
First seen:2020-12-10 11:38:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:kY3iCoGxz/S6ZSYrsPl5VGWl7sz8NeXyLj:8bGxzzs95dlAw8o
TLSH 03A423287453A04C5943ADF2F6EA79EB3826E1C092C838BF58BB59BB52730D507D1DB4
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: transpro-logistics.com
Sending IP: 103.99.1.159
From: Accounts<moonis@transpro-logistics.com>
Subject: RE: Revise PI
Attachment: Revise PI.rar (contains "Revise PI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4d51781ac8e03554461d9f410249faa92ee8f67030d58bc508f58d7d254860f/
Threat name:
ByteCode-MSIL.Trojan.Masslogger
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 10:36:14 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tkrpanmrybvkrdb3h2baje7vkjo5d3hamgvrpcqr5mnpusuqyhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d4d51781ac8e03554461d9f410249faa92ee8f67030d58bc508f58d7d254860f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar d4d51781ac8e03554461d9f410249faa92ee8f67030d58bc508f58d7d254860f

(this sample)

Formbook

Executable exe fed568f2ea01aab915cf34cbae9762d0b6002ae51679980975b9d25f55ae9514

  
Dropping
MD5 d9a8652020e9dd372b1631fd8ffa5471
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fed568f2ea01aab915cf34cbae9762d0b6002ae51679980975b9d25f55ae9514

Comments