MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f01e62d69c389fb8a14ad92459a800377a38a33967392f65af127975adf0e256. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f01e62d69c389fb8a14ad92459a800377a38a33967392f65af127975adf0e256
SHA3-384 hash: 47ae32de8647424e17917d1f67cfca589a930a0a5d20624bd74b3f3db0e2a2ce2ff215e5efd61eb73f500356c005218e
SHA1 hash: 9f84165d4de710f5a42c82079bd47c9af8fc09f8
MD5 hash: 4261464dcbf3df950e538a9851cf9d4f
humanhash: tango-spaghetti-social-hamper
File name:PO SAMPLES 9-1009-GRGS 403.2MT STR20 MIX.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:335'959 bytes
First seen:2020-08-18 13:27:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:N948aPLsxj498l5IePTO27s8/ZAcxeiwlYvK4lgHTHys044JH0tf3:ohDoEOLImD7s8/Kc8wBlgHB
TLSH 4F6423D7B904D445E26CA4552D80D1002B3B95683DE86B3B67351E82F7EFBB0F992ACC
Reporter abuse_ch
Tags:Endurance FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-214-233.unifiedlayer.com
Sending IP: 162.241.214.233
From: Eunji Kwon (Ms.) <juhanlee90@hec.co.kr>
Subject: Request for Quotation for PO 9-1009-GRGS 403.2MT STR20 MIX
Attachment: PO SAMPLES 9-1009-GRGS 403.2MT STR20 MIX.rar (contains "PO & SAMPLES 9-1009-GRGS 403.2MT STR20 MIX.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f01e62d69c389fb8a14ad92459a800377a38a33967392f65af127975adf0e256/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:29:03 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6apgfvu4hcp3rikk3esftkaag55drizzm44s6znpcj4xllpq4jla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f01e62d69c389fb8a14ad92459a800377a38a33967392f65af127975adf0e256

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar f01e62d69c389fb8a14ad92459a800377a38a33967392f65af127975adf0e256

(this sample)

Formbook

Executable exe 0a24de6dc7649dec6421707d17740a28c2e6bc292206f585713c6ff17e7f6112

  
Dropping
MD5 dd4c8f34f263b8489a1d2052759134db
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0a24de6dc7649dec6421707d17740a28c2e6bc292206f585713c6ff17e7f6112

Comments