MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d52cd6e109f8f4688257c2b92a6d58ffd2ae88abc5ffca1120756e4cd599fac5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d52cd6e109f8f4688257c2b92a6d58ffd2ae88abc5ffca1120756e4cd599fac5
SHA3-384 hash: 78d72d35a2883e6b86861685217bd9eb4f5283c833a6d54601d92eecb3db001cb330e8064a8447a425ade57724a1cbe6
SHA1 hash: c2bdafc164531e66b43649132a2e1867bcb145bc
MD5 hash: 55b0fb1f8eab34a44ad5d51fc99b671a
humanhash: oklahoma-foxtrot-sad-alpha
File name:NEW PO.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:184'921 bytes
First seen:2020-08-13 03:21:20 UTC
Last seen:2020-08-13 04:08:49 UTC
File type: z
MIME type:application/x-rar
ssdeep 3072:klUWIWtUB3yPby9c8O/x8ntQc9AtAWw/Rbw/N0uJAX5dh27GHO:kKJ1y29eqGfyRbgK5d8mO
TLSH 7B04128D58C42EE71A97E325D707DF5EBAC490EECABFC596048B12F509BAF1461E4803
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email
From: Ann<sales@anttools.com>
Received: from anttools.com (unknown [62.113.215.235])
Date: 10 Aug 2020 02:06:03 -0700
Subject: NEW ORDER PO 987654
Attachment: NEW PO.Z

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d52cd6e109f8f4688257c2b92a6d58ffd2ae88abc5ffca1120756e4cd599fac5/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-08-07 08:57:59 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uwnnyij7d2grasxyk4su3ky77jk5cflyx74uejaovxezvmz7lcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d52cd6e109f8f4688257c2b92a6d58ffd2ae88abc5ffca1120756e4cd599fac5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z d52cd6e109f8f4688257c2b92a6d58ffd2ae88abc5ffca1120756e4cd599fac5

(this sample)

Formbook

Executable exe d77b158058cb4a8ba8817a630e3d664e01f5f4f7cf1069d25e256b987eca1a6f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d77b158058cb4a8ba8817a630e3d664e01f5f4f7cf1069d25e256b987eca1a6f
  
Dropping
Formbook

Comments