MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbb2e50bc17ff79ae31d01a04ebc0f516a04ac28b5ffdd556a3dfc0541de5e3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbb2e50bc17ff79ae31d01a04ebc0f516a04ac28b5ffdd556a3dfc0541de5e3c
SHA3-384 hash: eed3b5676422bd91956f0d0fe5048c3c7179c9f2f393b5f2ecde7c665e2402e76ce1ca8b7f834c69ec1c104c8c26f3b3
SHA1 hash: 7321549c671c8993f3981f68fa4da86954ae8eb5
MD5 hash: 77dc078d1d6b77cf397a187581c494f5
humanhash: glucose-whiskey-cola-georgia
File name:Swift Copy PDF.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:277'746 bytes
First seen:2020-05-08 07:47:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SzDSJVNHkuW8BxNR16hyZwvEbqvKfg1exX1AG8Kb:3JMwxNKysOqC41y2Mb
TLSH 434423BCF352F06A62D58753327D02478346A598831BBDC5FE9835EAF1AF677801226C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: services.econerds.de
Sending IP: 139.59.209.218
From: Nguyet Nankta<FAPL.Info@fujitsu.com>
Subject: Bank Swift Copy / Wire Transfer Receipt
Attachment: Swift Copy PDF.zip (contains "Swift Copy Pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Barys.50278.19652.24644.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 12:23:57 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ozokc6bp73zvyy5agqe5papkfvajlbiwx752vlkhx6akqo6ly6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip dbb2e50bc17ff79ae31d01a04ebc0f516a04ac28b5ffdd556a3dfc0541de5e3c

(this sample)

FormBook

Executable exe a50d19ddd0b87fdc2529cfb1676f14297125443103286553fbcdf4ffa989f8e7

  
Dropping
MD5 9a426dc20fda9d009e9420df7b25d4be
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a50d19ddd0b87fdc2529cfb1676f14297125443103286553fbcdf4ffa989f8e7

Comments