MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f962ff7a2e7d4c42c1b435f5ab1799b5deace3a032ae801618a2116b268131f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 6
| SHA256 hash: | f962ff7a2e7d4c42c1b435f5ab1799b5deace3a032ae801618a2116b268131f7 |
|---|---|
| SHA3-384 hash: | 63faac3b7f63aaf43e5a0521461bc7e0ccfab5c4ce0ae955e2dfb6c06004d4c5913a78bf040c7ec8e9bab572d883b2ad |
| SHA1 hash: | b76bb9c315b6980d407a31dd5560364d24426b2d |
| MD5 hash: | 7a45043af5b34be239ac92a827c93c7c |
| humanhash: | fifteen-charlie-eight-october |
| File name: | Purchase_Order_EK_RA30151_MontJade_Engineering_Co_Ltd_752311.xz |
| Download: | download sample |
| Signature | Formbook |
| File size: | 875'752 bytes |
| First seen: | 2020-12-04 06:28:00 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/octet-stream |
| imphash | 0b53c587d92252505a138d0d9f3f823f (1 x Formbook, 1 x Loki) |
| ssdeep | 24576:eDTLDJqe+iGA21IeK/PtFOqxiyqrYnUr5IU3:q7+iGAWr/b3 |
| Threatray | 38 similar samples on MalwareBazaar |
| TLSH | 0B15122232E48073F4B756385CA9C7A0DDB5BC346A71890EBFD5475E2E30A92C72A753 |
| Reporter |  fabjer |
| Tags: | archive |
Intelligence
File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Trojan.Bluteal
Status:
Malicious
First seen:
2020-12-02 01:35:42 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 28 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Gamarue
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.