MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1666063e70b6ca1dcdc144d7cd2295424e2f4447db451d330b7aa8aff954dbd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1666063e70b6ca1dcdc144d7cd2295424e2f4447db451d330b7aa8aff954dbd6
SHA3-384 hash: 83b554f0f411b564fb239c2e99673f17a6dbbeb4268968b9ca16095814aa604273f1e517878bb7f3e1c40bb8af9742d4
SHA1 hash: cf5999bdf4c39dc60e2de799e8fec3e6dd13795f
MD5 hash: f7ced0ee5f69fc1bc903ce59d2a046ee
humanhash: happy-oregon-spring-summer
File name:Shipment Document BL,INV and packing list.jpg.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:433'969 bytes
First seen:2020-12-03 07:05:22 UTC
Last seen:Never
File type: ace
MIME type:application/octet-stream
ssdeep 12288:IQDTYbKXGM0UfumJ6LLVydczgLlpvDSFF:5g+Gm7zLldGH
TLSH 939423AD67A2BB8440C44756DC4CE5672B6BA9A50CA07335C7F6BB6C70BF3039412E27
Reporter cocaman
Tags:ace


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL International <info@assoitaly.it>" (likely spoofed)
Received: "from assoitaly.it (unknown [37.49.225.168]) "
Date: "02 Dec 2020 22:26:12 +0100"
Subject: "Shipment Document BL,INV and packing list"
Attachment: "Shipment Document BL,INV and packing list.jpg.ace"

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1666063e70b6ca1dcdc144d7cd2295424e2f4447db451d330b7aa8aff954dbd6/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-12-02 07:00:14 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1666063e70b6ca1dcdc144d7cd2295424e2f4447db451d330b7aa8aff954dbd6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 1666063e70b6ca1dcdc144d7cd2295424e2f4447db451d330b7aa8aff954dbd6

(this sample)

Formbook

Executable exe 9ee03e901beffb470c6ee938587d92c1ed230139d38f1fbf9f2ac8da0615e79b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9ee03e901beffb470c6ee938587d92c1ed230139d38f1fbf9f2ac8da0615e79b

Comments