MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5
SHA3-384 hash: 6afc5a1916e2a924e79605aec290c6cf820e0ce0a7b9bf09a079c884939c1ee656f1407cf3152ee66f77e702511dc9a3
SHA1 hash: c416b0ba2b9086b2fd99ef8abfc17a048c327963
MD5 hash: 6de77759b378fb8dce0601a589b77755
humanhash: helium-georgia-sweet-snake
File name:SHIPPING DOCUMENTS.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:248'138 bytes
First seen:2021-03-30 06:26:55 UTC
Last seen:2021-03-30 08:10:54 UTC
File type: gz
MIME type:application/x-rar
ssdeep 6144:uX4sbeKqFTUEDZqWaxvbyqQKOBkzDPNt8f4NFq9cn:PselBaxvTQK2kzDPNtqMb
TLSH 1A34233365363FE75888BEBC62681CA10D337B5A28C6957CE5A49049850BB74F183F8B
Reporter abuse_ch
Tags:gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 126.com
Sending IP: 45.137.22.138
From: Cherry <zamy0001@126.com>
Subject: Marine Open Policy No. MP/O/10/000116/11/2020/DT, CMIC Chloride - 6000 Kgs. against L/C No. LC/99/082/3087
Attachment: SHIPPING DOCUMENTS.gz (contains "SHIPPING DOCUMENTS.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 23:53:02 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
9 of 29 (31.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ahjmetcu7mn3ldnadgbpn3syuvmokpvjj6v3plupxwyexzkeo3kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5

(this sample)

Formbook

Executable exe 8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279

  
Dropping
MD5 46398b3bfed1b6e8944ddf8d15a34a02
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279

Comments