MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47276b62ebc04b0c0e845f55afc2f7cff86597625d534830551467420cd9203. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47276b62ebc04b0c0e845f55afc2f7cff86597625d534830551467420cd9203
SHA3-384 hash: 2504fccdff8aac790fecb6c00b6960a19684c2ea9bc8047e12b16f493865ac0ce5a2c79649ec79003d7c7501e4e709dd
SHA1 hash: 5cf5a43907001bb86fa72db82ee4aaf66b8a36c8
MD5 hash: 0fe36e2930f6b1175ca15b5ff4bcf2ce
humanhash: kentucky-july-bakerloo-bravo
File name:Bank Swift.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:461'724 bytes
First seen:2020-10-15 13:05:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:aLXLb6ZwOxL67toue92mjynbnxF7iIJmAZvbWi:Wb6ZweMJ6snbnxF7/lbWi
TLSH 39A423DF2CD0331209733DFD9A5988A2855F57D8A7A4711C23A534A8BD6C6E7C88FA43
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosting.kenwaresolutions.com
Sending IP: 173.231.198.30
From: annieneo <annieneo@tokiomarine.com>
Reply-To: andrea.gerigk@tri-lan.com
Subject: FW: SOA Review Done : Inter Bank Transfer(IBG) URGENT
Attachment: Bank Swift.rar (contains "Bank Swift.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47276b62ebc04b0c0e845f55afc2f7cff86597625d534830551467420cd9203/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 12:11:08 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4rzhnnroxqclbqhiix2vv7bppt7ymwlwexktjayfkfdhiignsibq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e47276b62ebc04b0c0e845f55afc2f7cff86597625d534830551467420cd9203

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar e47276b62ebc04b0c0e845f55afc2f7cff86597625d534830551467420cd9203

(this sample)

Formbook

Executable exe a9675f768840e844de5923c2319cae51ba47ca5eee5c50c58418d274d5985520

  
Dropping
MD5 92c4ac872029dc31e3e798cbabc3afd5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9675f768840e844de5923c2319cae51ba47ca5eee5c50c58418d274d5985520

Comments