MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7ecfaeac5396a71dfb3d37217125df96e854c2920da7d474184145445f13896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7ecfaeac5396a71dfb3d37217125df96e854c2920da7d474184145445f13896
SHA3-384 hash: e9bbaddcf964d7684fe661042c01f098a046470acf6e29ba78e354e6659a22b0cb73cd6516cd4f4b04eeafd9504b5361
SHA1 hash: ab83ea20dc54304d755cfd874510129ccbeb0bae
MD5 hash: fd26a83ec3b8bee5f6bb778b98a47629
humanhash: vermont-juliet-foxtrot-november
File name:Bank statement _06062020-13qUM7BJqk1w4YYK4wRbgM6ArKzvZovtqL.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-06 09:44:27 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:qXbNb4ZaB+O+NY3lQopxnLxgyTDdgPy6VHBy9/17ls6oUgN:qXpQakilhKeJmEJ17l8
TLSH 4545DF51EA94E25BE5645BF78A3316280337AD78A520DA6D38CD7CF01B337870A5293F
Reporter abuse_ch
Tags:FormBook geo img USA usbank


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: o1.ptr4613.smartmailx.com
Sending IP: 149.72.242.180
From: U.S. Bank <no-reply@notification.usbank.com>
Subject: Statement Available
Attachment: Bank statement _06062020-13qUM7BJqk1w4YYK4wRbgM6ArKzvZovtqL.img (contains "Bank statement #06062020-13qUM7BJqk1w4YYK4wRbgM6ArKzvZovtqL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.MSILPerseus.225259.21426.23495.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 09:46:06 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=67wpv2wfhfvhdx5t2nzboes57fxiktbjednh2r2bqqkfirprhcla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img f7ecfaeac5396a71dfb3d37217125df96e854c2920da7d474184145445f13896

(this sample)

FormBook

Executable exe 2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f

  
Dropping
MD5 c9b0c4cb22b9f6ca2ba4e65a6ddd3f85
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2fdf0daf15395bf89c3baab2efff427dd7026ba306bb5c77c5f5598f5c6eb30f

Comments