MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f637d170a539b7418c9da3506bc437edd21c854313fc7a2a4b03f675a63a4ae1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f637d170a539b7418c9da3506bc437edd21c854313fc7a2a4b03f675a63a4ae1
SHA3-384 hash: ef2b9b88424b8348924e131281f90bd5cb665564333eabb0250f98d565a070338bfcd3cda84ed7156f112c092b3e3509
SHA1 hash: 68706620d387d17fb0abe8f8d24ae02cc8a6f8e7
MD5 hash: cde4a32842894a698985654817e5a27b
humanhash: artist-nebraska-quiet-yankee
File name:teklif.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:346'061 bytes
First seen:2020-08-18 19:40:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:GLNkFWXpXATjiOUbGdDRyywVB9VTga7fGGASw50+p3NkOZ+:Go8pwfibG81fnxw06dkv
TLSH 257423938A22EC7C398C72C5923ADE8D1DB1BE9AC7D58A45D79429F0F6C1F5CC235089
Reporter abuse_ch
Tags:FormBook geo rar TUR


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: lx1.morvanet.com
Sending IP: 46.4.222.5
From: info@arvinarman.com
Subject: Re: Re: AW: AW: yeni sipariş sorgulama
Attachment: teklif.rar (contains "teklif.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f637d170a539b7418c9da3506bc437edd21c854313fc7a2a4b03f675a63a4ae1/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:42:08 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6y35c4ffhg3udde5unigxrbx5xjbzbkdcp6hukslap3hljr2jlqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f637d170a539b7418c9da3506bc437edd21c854313fc7a2a4b03f675a63a4ae1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar f637d170a539b7418c9da3506bc437edd21c854313fc7a2a4b03f675a63a4ae1

(this sample)

FormBook

Executable exe 3b098abf608b9def35a0cabf2e548dfe01d4f575f6406770be29a25439785978

  
Dropping
MD5 9f5f0a9318f01aba5f2e413cf55f30ee
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b098abf608b9def35a0cabf2e548dfe01d4f575f6406770be29a25439785978

Comments