MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4
SHA3-384 hash: 0f7719c55583766cb63d5b9314ec5f70508f740cf0f0b4a75ea539187beacfec7f4417819af7eb55ab84b26b7416b07f
SHA1 hash: d4a8ac24051df88ce93c8e9b8a516d2cf4143ab5
MD5 hash: a6adb58f208e73b1212f59886c87e1c7
humanhash: hydrogen-stairway-north-jig
File name:Glxfra.z
Download: download sample
Signature Formbook
Create hunting rule
File size:478'144 bytes
First seen:2022-08-03 08:07:44 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:20cdNXSRhCkhj62xZ0tbYjQYad1Smt8Cf:YfXS2u22/QYa3SU8y
TLSH T198A423AAD7CB02E2D0E8B67D9335242706DC275349AED662183AD919CDF518FC01ECCB
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: ""Muriel "<rut.bla@cyberbaiseuses.com>" (likely spoofed)
Received: "from oapcfkrz.cyberbaiseuses.com (unknown [85.217.145.44]) "
Date: "02 Aug 2022 20:51:31 -0700"
Subject: "new order."
Attachment: "Glxfra.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-08-03 02:22:15 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
18 of 40 (45.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=64vw5mct6qt6e6j32evlnoxhqhzoxbufmhgfi7oauf5kt6zswwsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z f72b6eb053f427e2793bd12ab6bae781f2eb868561cc547dc0a17aa9fb32b5a4

(this sample)

Formbook

Executable exe 1e2e1fecda1667f10e086d9f86458dadf8ab19874abf16a36e669a6c87d845e8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e2e1fecda1667f10e086d9f86458dadf8ab19874abf16a36e669a6c87d845e8
  
Dropping
Formbook

Comments