MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c1abcaa28ab53bc3cb9fc8eaef70346fe6a40d260e77b21919b8b128573d30c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c1abcaa28ab53bc3cb9fc8eaef70346fe6a40d260e77b21919b8b128573d30c
SHA3-384 hash: 7778923ff39510d8a8cf23c5adf382e663c08a7de2e9f68519dd63b3d1c79dff71b02b60a08edc00f206f55fdc3ed5f9
SHA1 hash: 63fa5bc91c0556153a28ae0cd299e8453451b954
MD5 hash: 7a6b79a56a85dda693fa63d623c2cb99
humanhash: juliet-venus-tennessee-robert
File name:payment advise.z
Download: download sample
Signature Formbook
Create hunting rule
File size:15'906 bytes
First seen:2020-12-17 08:54:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 192:iG6dJg98Td1tuYkIJyDUYQ82BaEReh/6IcL0GvIWMD7oYHPPT9aZ6nm81k:GgKPoYLJyAtvaqG6Iu0GvI3DvH38N6k
TLSH 8C62D034EA65F231CC66E75079218845923707680CE9C9D161AD8B8F4CC8FDBA330A37
Reporter abuse_ch
Tags:z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: correo.trcnet.com.ar
Sending IP: 190.227.12.3
From: Ege Termo Elek. İnfo <vera@credifinexpress.com.ar>
Subject: Fwd: Urgent Confirmation
Attachment: payment advise.z (contains "payment advise.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownloaderNET.106.17731.21078.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c1abcaa28ab53bc3cb9fc8eaef70346fe6a40d260e77b21919b8b128573d30c/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 02:16:09 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bqnlzkrivnj3ypfz7shk55ydi37guqgsmdtxwimrtofrfblt2mga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Dropper
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/0c1abcaa28ab53bc3cb9fc8eaef70346fe6a40d260e77b21919b8b128573d30c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 0c1abcaa28ab53bc3cb9fc8eaef70346fe6a40d260e77b21919b8b128573d30c

(this sample)

Formbook

Executable exe 1af16016b5773b6d22f0d0e5f93392e909d3505d22ef1cefb8127798de67760f

  
Dropping
MD5 d31b38cb903007f085c9b18bdec09759
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1af16016b5773b6d22f0d0e5f93392e909d3505d22ef1cefb8127798de67760f

Comments