MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 213cdf2b9ec68504fc938deb654be3c8f9da34b1b885fff7b95d389f7dbfa1a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 213cdf2b9ec68504fc938deb654be3c8f9da34b1b885fff7b95d389f7dbfa1a5
SHA3-384 hash: 05e2ac1b6f1b98dfb6d33e4c1c3ee34305adbe0298ba0c918e2d2a1bbf26793e078375de46644d70891f0cbc75487dc7
SHA1 hash: b139c83bbc0641874e89afdce6813a78dca53dac
MD5 hash: e6cd4a6c1b3dfa5dc42ad3ac0d4047a2
humanhash: december-aspen-moon-maryland
File name:202005PO.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:230'437 bytes
First seen:2020-05-20 07:52:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Au651nhjRYkocFAupuzFjX2zKXKHzDcJDbcXeJpkjpp:Ap51nT/PpauCKTDGbWevyp
TLSH 2F342352A0773A1A779E74391BF39BD3216A5813D444E72D7840B34ECEA1ED83B93368
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: outgoing32.cpt4.host-h.net
Sending IP: 196.40.103.62
From: rika@sscomp.co.za
Reply-To: henry@diwatg.com
Subject: New RFQ May
Attachment: 202005PO.rar (contains "202005PO.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 08:36:35 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ee6n6k46y2cqj7etrxvwks7dzd45unfrxcc7755zlu4j67n7ugsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 213cdf2b9ec68504fc938deb654be3c8f9da34b1b885fff7b95d389f7dbfa1a5

(this sample)

Formbook

Executable exe e5d4600354cad7a882caac33f0e18bc6702a269dab9315ef71835fbbad747626

  
Dropping
MD5 85ed62c99b90eae46f2147c4565bc256
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e5d4600354cad7a882caac33f0e18bc6702a269dab9315ef71835fbbad747626

Comments