MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16ab316c9c7addcb3b3ba1c0c73d3a64d1cd3a3e45241c45a80a6ade10c63629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 16ab316c9c7addcb3b3ba1c0c73d3a64d1cd3a3e45241c45a80a6ade10c63629
SHA3-384 hash: 67cd4d2259a4ba8fd53deb67b9ae4d7ce6fd76de41dad4aee30877e1b07edefb7472bd69fccfd48e3662fb1ab4c4ae0d
SHA1 hash: 2a7985be3b20eed5aa6d4dc435db41d9b20e34aa
MD5 hash: d6c5a453883a35c9775ec22c535c8031
humanhash: bacon-sierra-cardinal-three
File name:ofertă de comandă.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:349'035 bytes
First seen:2020-08-18 19:24:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:dlKO/rO4J2ogkd9SC2h/8O3x2G0vAEdjQt75tVF7WM0nVRs5NlhWMZYWBIJkpqFT:dlKqxJsDh/8O4G0MlVFSrRkjlYX6pqB
TLSH B874239D0DB81B3A64AC5EDB9B41457914EBF4168B0B52A09FFC1320E63E40EF6F4B49
Reporter abuse_ch
Tags:geo ROU zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Avram Violeta <sales@plastics-bavaria.ro>
Subject: Re: Re: nou ofertă de comandă
Attachment: ofertă de comandă.zip (contains "ofertă de comandă.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.405.16701.13549.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/16ab316c9c7addcb3b3ba1c0c73d3a64d1cd3a3e45241c45a80a6ade10c63629/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 19:26:05 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c2vtc3e4plo4woz3uhamopj2mti42or6iusbyrnibjvn4egggyuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/16ab316c9c7addcb3b3ba1c0c73d3a64d1cd3a3e45241c45a80a6ade10c63629

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 16ab316c9c7addcb3b3ba1c0c73d3a64d1cd3a3e45241c45a80a6ade10c63629

(this sample)

Formbook

Executable exe ffaada37aa4934d94b43628a932058196e3e9d5b4375873fa440c8c2bde97326

  
Dropping
MD5 617d35386ee9c542ca093bf4fbd4c8b4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ffaada37aa4934d94b43628a932058196e3e9d5b4375873fa440c8c2bde97326

Comments