MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f664e1fd3dddf3dcc2b9e771b06e320d918f008c86079724e94986dfff964047. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f664e1fd3dddf3dcc2b9e771b06e320d918f008c86079724e94986dfff964047
SHA3-384 hash: df93b792a5a97c965020a2adc20d1d3ecb54e85fe7fc8dc7bfa7d68f362b23db0f3404e7a5930cd133cf3391eb040811
SHA1 hash: 5fd96d2f7265213a9fde34e0657dd18389d68735
MD5 hash: 0fb00c774a3e54c22410cc1158f878eb
humanhash: failed-aspen-nuts-nebraska
File name:Remittance Scan DOC-2029293PI207-048.pptx.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:927'730 bytes
First seen:2020-10-19 18:22:47 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:KAth02Xwgp29BUHYij/T3pzlmhb33UgojuwLPGD9HvvCzGdiaZZ2pSXdRkL0EI1s:KoE2IBAdL3px+7QMCVaZZUvI123l
TLSH 7115335304B244FF8E1718DA68772BB7F451BEFA254AED4FDF406BA026D05AB9CB4420
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: geodis.com
Sending IP: 83.149.106.6
From: Nemanja Mijatovic <nemanja.mijatovic@geodis.com>
Subject: RE: Transfer Remittance (PI207-048)
Attachment: Remittance Scan DOC-2029293PI207-048.pptx.gz (contains "Remittance Scan DOC-2029293#PI207-048.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.RarMal-C.1469.27696.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f664e1fd3dddf3dcc2b9e771b06e320d918f008c86079724e94986dfff964047/
Threat name:
Win32.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 17:27:37 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zsod7j53xz5zqvz45y3a3rsbwiy6aemqydzojhjjgdn774wibdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f664e1fd3dddf3dcc2b9e771b06e320d918f008c86079724e94986dfff964047

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz f664e1fd3dddf3dcc2b9e771b06e320d918f008c86079724e94986dfff964047

(this sample)

Formbook

Executable exe 75f121f9048171649f3ba28afcd30a1dcd668266717b0d98e8bac88afe411fe7

  
Dropping
MD5 b382a702dd1812f0d4aa3b041ee809d7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 75f121f9048171649f3ba28afcd30a1dcd668266717b0d98e8bac88afe411fe7

Comments