MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d681facd2e5ba7b9f6331029b1963b05edea582ed1db5ca8afdcf1a73d2dacd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d681facd2e5ba7b9f6331029b1963b05edea582ed1db5ca8afdcf1a73d2dacd6
SHA3-384 hash: d40e4a0c0a990f7832d735ec7761b58789eaafcbec1a573173b93cf1e51f94047bc1f7da1f949c6433d6f8ff41ec5624
SHA1 hash: 341ad09a4998618c6219734363f68759883d36e0
MD5 hash: 42463cd5943c3533be312ba13fd4a27f
humanhash: asparagus-uncle-mobile-freddie
File name:Purchase Order.r11
Download: download sample
Signature Formbook
Create hunting rule
File size:463'519 bytes
First seen:2020-10-21 09:56:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UpZyhbMSSWKxPFEpvH0FB37yuHRO78BoH+N/8oO0NVGKqAa2:7yBrcvHcrydoB++NxNVLb
TLSH 39A423C238ED68A8F2F162F42E71D61E3F4205FD295EDC470832976992BB56C9412F6C
Reporter abuse_ch
Tags:FormBook r11


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.fore-mbaume.com
Sending IP: 45.95.169.145
From: Mashalla.Gogadi <info@fore-mbaume.com>
Subject: Purchase Order
Attachment: Purchase Order.r11 (contains "Purchase Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d681facd2e5ba7b9f6331029b1963b05edea582ed1db5ca8afdcf1a73d2dacd6/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 01:58:23 UTC
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=22a7vtjolot3t5rtcau3dfr3axw6uwbo2hnvzkfp3ty2opjnvtla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar d681facd2e5ba7b9f6331029b1963b05edea582ed1db5ca8afdcf1a73d2dacd6

(this sample)

Formbook

Executable exe bd3bf49f455f519888272ddfe3e9a0603958e64e3bed5a80078bddf65276def2

  
Dropping
MD5 358dcdb4abed9fb934f769d7a6eb2749
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd3bf49f455f519888272ddfe3e9a0603958e64e3bed5a80078bddf65276def2

Comments