MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230
SHA3-384 hash: ae6eabcb77eb8dcdf1fc4136996ee28e3b1d48b695155c5058da60685af8415b4bbb13d8e5ddc706236c70869ab020fb
SHA1 hash: 8e264a972bf2ffa279af0dbba95a04260e630547
MD5 hash: 03a0f7b18a2a74d9a3c87979907c21ef
humanhash: blue-thirteen-skylark-xray
File name:request_quotes.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:643'366 bytes
First seen:2020-10-22 07:40:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:jTKWICfCoFhdgaXw3EEgZbRb5NEWQBtEvbStaUO+imZ/+KF:jUWBhAgBRdyPoFUVR
TLSH C0D433488CF1434280E6A1025C2DAFEB3153AB9D14E9FD4963996B347DAB65F07D04BF
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.blakecorporations.com
Sending IP: 199.250.204.180
From: M Hanif Azis (malaysia) <Azise.hanif@petronas.com.my>
Reply-To: M Hanif Azis (malaysia) <purchase2@workmail.com>
Subject: request quotes_urgent_purchase
Attachment: request_quotes.zip (contains "request_quotes.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:43:55 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aljknashdnepqbnumqahlf5oi57ollaq7xqw7htruvyxjzd4qiya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 02d2a682471b48f805b464007597ae477ee5ac10fde16f9e71a57174e47c8230

(this sample)

Formbook

Executable exe a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25

  
Dropping
MD5 64bb9b8f6800fe0d658195ebfb066518
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a50fdfd2a59cafe23cd41227b465d44b6d00e2b14f707798d60d2637ff78ef25

Comments