MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8a553f207854e50c4400a52e9ed9a08d68f95c96028e0ee79cdffaa00f2c72f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8a553f207854e50c4400a52e9ed9a08d68f95c96028e0ee79cdffaa00f2c72f
SHA3-384 hash: 41779c3b8d1dbba55065c376720e0cdd68e7ba3d0aa1140338159dac10fcf54d5d1b0faa9f3eaf82e6b5d7c169ad6e82
SHA1 hash: f6452bf6da509fc5375b629f114c341c805b88e0
MD5 hash: 3d5c94eca2320d0241defbfb219483b0
humanhash: hydrogen-florida-fifteen-xray
File name:IM930984.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:333'778 bytes
First seen:2020-10-20 08:36:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:0ZDFpsevTT2oKF6WS4db7SO3v7W8ZPyqoFivCirmlZ3WjtND0njewi0jMQkgPunR:mFCevTSp694dSOC6PKi6lZ3RCwizQkgA
TLSH F46423285043F1398CFCAA2DC63BEF393BDB33E092766DAB752D2D4C542B9A84755510
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.exlabesa.com
Sending IP: 79.137.45.222
From: Carol -Salazar <logistica@dominos.com.pe>
Reply-To: Carol -Salazar <mgraoui-ssd@planetmail.net>
Subject: DEPOSITO 16.10.20
Attachment: IM930984.zip (contains "RQ100932871.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8a553f207854e50c4400a52e9ed9a08d68f95c96028e0ee79cdffaa00f2c72f/
Threat name:
Win32.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 19:52:41 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7csvh4qhqvhfbrcabjjot3m2bdli7fojmauob3tzzx72uahsy4xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.87
Link:
https://yomi.yoroi.company/submissions/f8a553f207854e50c4400a52e9ed9a08d68f95c96028e0ee79cdffaa00f2c72f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip f8a553f207854e50c4400a52e9ed9a08d68f95c96028e0ee79cdffaa00f2c72f

(this sample)

FormBook

Executable exe a59693f90c55791c544845b00cd4a8e6333d83cc83c8d8be42a7b028af4098e0

  
Dropping
MD5 33de5150c627c6f5ba4787ad6899eb2a
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a59693f90c55791c544845b00cd4a8e6333d83cc83c8d8be42a7b028af4098e0

Comments