MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd96f3484ec9e1d2f5382fda82cf28b6cd1a281d77e9310591423537f8a671c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd96f3484ec9e1d2f5382fda82cf28b6cd1a281d77e9310591423537f8a671c5
SHA3-384 hash: b75b65d264dec6351f5bc967dbcdce0c611c573853ced8f4b2f3d6dfdbb1bd37e431d462a90b3995d0e21b31f599183e
SHA1 hash: f28413afa1135603f0f57734e6d00a2ef3d84f74
MD5 hash: 7c5ed2ac79d43bfbbc657e5f1b8ea002
humanhash: indigo-venus-fix-eight
File name:RFQ052020.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:485'790 bytes
First seen:2020-05-05 10:01:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ljvVpPDV/qMqFNeo6pcEyYqx2jmR50LiUSnUVXitJtWkgJtPY:ljdpPDxq3eV1qojowgTW/tw
TLSH 86A423E33A297F2EC9DEC125B24C7C7292C765BE598A91B1B970C2AADD6460374C20D0
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: host.qomlavy.com
Sending IP: 69.16.254.67
From: henry@diwatg.com
Reply-To: henry@diwatg.com
Subject: New May RFQ
Attachment: RFQ052020.rar (contains "RFQ052020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.GenKryptik.EJXE.4577.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Inject
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:36:40 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wlpgscozhq5f5jyf7niftziw3gruka5o7utcbmrii2tp6fgohcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar fd96f3484ec9e1d2f5382fda82cf28b6cd1a281d77e9310591423537f8a671c5

(this sample)

FormBook

Executable exe 4b2c4e99f90ead8a22dd705733b21dbc32b71344e2022e229ff59d967e359203

  
Dropping
MD5 01ddf6ca2d833e79e1ea1000b3e8b260
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4b2c4e99f90ead8a22dd705733b21dbc32b71344e2022e229ff59d967e359203

Comments