MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b99e5852e42c7fb0ea4750a7b4376def04b2fb95545970c8a2976091fdf3606. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b99e5852e42c7fb0ea4750a7b4376def04b2fb95545970c8a2976091fdf3606
SHA3-384 hash: 613c1e684a767756274c902262c401637e80349408b3a03f49982496781bdc52388f9d708f5c1d0d62f2471fb512f041
SHA1 hash: 3a9b049ba9bb7a5d0f7bf15e33b926b994636685
MD5 hash: 148eef0f72c9922ea1f7fa7198eeb3be
humanhash: potato-finch-oranges-connecticut
File name:invoice, #0084.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:457'622 bytes
First seen:2020-11-05 07:00:54 UTC
Last seen:2020-11-05 20:08:36 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:OkDfY3IiGY0rJtxtIi1qZszfKmG8xhREZ2h7j48f:FDfOlv0r/7o8xhRE+jF
TLSH 90A4232467F5504DFC04E9C5CD6E89918E19A7D62148FF1A908E889E1F1E6F03BE8F92
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "sales@gallopshipping.com"
Received: "from gallopshipping.com (unknown [103.153.78.33]) "
Date: "4 Nov 2020 15:49:27 -0800"
Subject: "=?UTF-8?B?Rlc6IOWbnuWkjTogcGFpZCBpbnZvaWNl?="
Attachment: "invoice, #0084.rar"

Intelligence

File Origin
# of uploads :
7
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b99e5852e42c7fb0ea4750a7b4376def04b2fb95545970c8a2976091fdf3606/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-05 04:03:18 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
20 of 29 (68.97%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dom6lbjoild7wdveoufhwq3w33yewl5zkvczodekff3ash67gyda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1b99e5852e42c7fb0ea4750a7b4376def04b2fb95545970c8a2976091fdf3606

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 1b99e5852e42c7fb0ea4750a7b4376def04b2fb95545970c8a2976091fdf3606

(this sample)

Formbook

Executable exe e38e6ac839b8009c1c6d467ed4206f912c39a15af7a1fa7ba4a2a854e441fe50

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e38e6ac839b8009c1c6d467ed4206f912c39a15af7a1fa7ba4a2a854e441fe50

Comments