MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0873ba3dfd8131b5a26f5d3849e1fb5a029d0e894c5861bff06be2851615bfaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0873ba3dfd8131b5a26f5d3849e1fb5a029d0e894c5861bff06be2851615bfaf
SHA3-384 hash: 1d482662aa812ebd4fd8cbb75933ea5bb9038f3d190c1189b9b0f95252e4d0fd275389b5e0f46005acf7e0c83cdfa106
SHA1 hash: 228fa3cce5a9e31482693a2533589765bc7dd08e
MD5 hash: 51600e35b88d2e9056e93cf85cd467ab
humanhash: alpha-october-spring-violet
File name:New Order 2922 Product Inquiry.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:581'998 bytes
First seen:2020-10-28 07:50:05 UTC
Last seen:2020-10-28 07:53:31 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:RxAjoNrCb5+tnODYbCKNgd4Te36eC+QBLcwbGYTqN7bJDcV+S:ROrtcOcbE2t+QBLcwCYTqNZI
TLSH 5BC423039B1E629B9CD3A5401937FD49A0BA8731DF60840E0F36CA1A77BB1EE59D1771
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: ACCYS EXPORT <manager.ali@ruadaelatlas.com>
Subject: New Order Inquiry/Contract
Attachment: New Order 2922 Product Inquiry.zip (contains "New Order2922 & Inquiry.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.jc.25029.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Generic.fm.32195.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0873ba3dfd8131b5a26f5d3849e1fb5a029d0e894c5861bff06be2851615bfaf/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 06:28:06 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0873ba3dfd8131b5a26f5d3849e1fb5a029d0e894c5861bff06be2851615bfaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 0873ba3dfd8131b5a26f5d3849e1fb5a029d0e894c5861bff06be2851615bfaf

(this sample)

Formbook

Executable exe eb4e7cd83e6986a52a3ad673a6994c6e917dd6bc70adfbccdf2c1a5348b72a0b

  
Dropping
MD5 5af741e9c6b6cdb708a61026db90e451
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eb4e7cd83e6986a52a3ad673a6994c6e917dd6bc70adfbccdf2c1a5348b72a0b
  
Dropping
SHA256 2052bf41efb320074624cc63d0fb048e7ae57a3f7e365de65ea9cf6766449d98
  
Dropping
MD5 8544d9405b17fc180c7dfe39d967b443

Comments