MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1bda786942300e009911838ae7b6f1c6919e9ac0023d85bba593dfd12edd5c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c1bda786942300e009911838ae7b6f1c6919e9ac0023d85bba593dfd12edd5c3
SHA3-384 hash: 90c034d0063324f5204d6c175b71df90360f400cd1a924c9fe5faf5e307c578c9740a21a6fd076d32793cac8c66000ff
SHA1 hash: 5a2e97029948c15438dd5e027ffa9d8fc5b43de7
MD5 hash: 35a9df4824560ff93d9df4b196a23768
humanhash: artist-california-muppet-skylark
File name:purchase order.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:358'464 bytes
First seen:2020-08-05 08:40:09 UTC
Last seen:2020-08-07 13:22:07 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:gPsDu2pJ8RI+xGPpwLe2ablarrx22MeQds+DyPJswu22Lw/WDATJngRQG8D:UYJuI+IqPabkrrQ2M9zyRS3w2ra
TLSH BC7423796D98F5EE088F4635D098840F0BF8D048545425EAEFF83C29CF972B6E961B87
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: noblehk.com
Sending IP: 103.99.1.145
From: kumar@noblehk.com
Subject: Re: Purchase Order
Attachment: purchase order.zip (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
9
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21199.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c1bda786942300e009911838ae7b6f1c6919e9ac0023d85bba593dfd12edd5c3/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:42:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yg62pbuuemaoacmrda4k463pdrurt2nmaar5qw52le672exn2xbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c1bda786942300e009911838ae7b6f1c6919e9ac0023d85bba593dfd12edd5c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c1bda786942300e009911838ae7b6f1c6919e9ac0023d85bba593dfd12edd5c3

(this sample)

Formbook

Executable exe 0c6ef50f134bbd723eddc99d8f9fc78b37e7e2590ec907ce4209075677add6d9

  
Dropping
MD5 be84baa98d7e27a0df361cd6eba9506c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0c6ef50f134bbd723eddc99d8f9fc78b37e7e2590ec907ce4209075677add6d9

Comments