MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08068e57c613d16459b7aa0f10f76e74103b36023f2fa24a9970b68018b9a0bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08068e57c613d16459b7aa0f10f76e74103b36023f2fa24a9970b68018b9a0bf
SHA3-384 hash: 2d23c70fb09ad778e3b528ca79ca6f9ffb641c5c3abbe67b044af72cfedf3f974c3e3b2243b8c6d9e236224ea30b101b
SHA1 hash: a5320f2dec92263c796e0643beca61202c71294a
MD5 hash: 576a37d0baa76dc7b4dc274fafd469d3
humanhash: quiet-queen-uniform-idaho
File name:5YfNeXk1f0wrxXmpdf.z
Download: download sample
Signature Formbook
Create hunting rule
File size:341'344 bytes
First seen:2021-01-16 07:32:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:e3ZendOZpddcarYQWD2lN2qdRsVQJezBcuvkNhkULHW/skUPeamx2cm:QInLqln8V4ezBcu+yU7W/skUmb0
TLSH AE7423DAFDC87E64CC71EBEB2406017996F954B5DC87302F510EA9E7229E1EB8323905
Reporter abuse_ch
Tags:FormBook Yahoo z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic316-54.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.69.30
From: Fiona Tan <fionatan898@rocketmail.com>
Subject: Fw: REQUEST QUOTATION - URGENT
Attachment: 5YfNeXk1f0wrxXmpdf.z (contains "5YfNeXk1f0wrxXm.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08068e57c613d16459b7aa0f10f76e74103b36023f2fa24a9970b68018b9a0bf/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-16 07:33:07 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=badi4v6gcpiwiwnxvihrb53ooqidwnqch4x2esuzoc3iagfzuc7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/08068e57c613d16459b7aa0f10f76e74103b36023f2fa24a9970b68018b9a0bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 08068e57c613d16459b7aa0f10f76e74103b36023f2fa24a9970b68018b9a0bf

(this sample)

Formbook

Executable exe 8b8fbe6805c361f5b04a198e8549a9797233faf4b9039004ebab000de593608d

  
Dropping
MD5 a6af527f30950267d700bbc88817cc3a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b8fbe6805c361f5b04a198e8549a9797233faf4b9039004ebab000de593608d

Comments