MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0516e542e0cb846cf945ae0f8036a755ad6ff7efe67e1de73c6215e9fe8649fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0516e542e0cb846cf945ae0f8036a755ad6ff7efe67e1de73c6215e9fe8649fc
SHA3-384 hash: a378c2713c973627a1efd6597922b18ac7b519f45eb3f9ad8b5420f97773aa834aa225392bf9b8b1091a61fe9d5414f2
SHA1 hash: 68e7c349785192fad7c6af6cdb4387e1541175ba
MD5 hash: 80c29960439c7ed2059e610489f08f18
humanhash: lemon-happy-red-kansas
File name:Quote48.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:540'904 bytes
First seen:2020-08-17 06:12:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Vts6fA8ATVz6xjYS31qayLc1N8NR74hW0ZJhnQowPGmHQ68:A6f8YjP3Ykq78fhJwuD
TLSH E7B423F6616DB37140CFE62F264D1AEE6A8F57594A037B4EA00C3FE2A64746C141393B
Reporter abuse_ch
Tags:Endurance FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Helen He < server@hinet.net>
Subject: Reminder for Quotation
Attachment: Quote48.zip (contains "kQ4yatOIcis2LmE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.51238.13774.9312.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0516e542e0cb846cf945ae0f8036a755ad6ff7efe67e1de73c6215e9fe8649fc/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:14:07 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aulokqxazocgz6kfvyhyanvhkwww757p4z7b3zz4mik6t7ugjh6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0516e542e0cb846cf945ae0f8036a755ad6ff7efe67e1de73c6215e9fe8649fc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 0516e542e0cb846cf945ae0f8036a755ad6ff7efe67e1de73c6215e9fe8649fc

(this sample)

Formbook

Executable exe 47e2cdade33723e82c06a0411695ff32f874ee73024f658cf8c00592dff729a8

  
Dropping
MD5 c41692460a68eb8c172121aad6608e88
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 47e2cdade33723e82c06a0411695ff32f874ee73024f658cf8c00592dff729a8

Comments