MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 211825b15c064794fb1b8201797bf03e089a261116d5ea5aa944cbaadcc63a14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 211825b15c064794fb1b8201797bf03e089a261116d5ea5aa944cbaadcc63a14
SHA3-384 hash: bfdaec69688a0a6b932ce276d9d181712f3184b738a81408bb380523bc333e06c083cb1c736b6a4dbc97768af812b49a
SHA1 hash: 7606f9d480990b4a5b2c154357181eb412c82928
MD5 hash: cfd4b29733ecc89e6246b00be9c2702e
humanhash: ceiling-pip-summer-red
File name:G0170-PF3F-20-02602T.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:610'800 bytes
First seen:2021-02-22 07:21:44 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:mp3FxjejbrzAYfAfOFhle+7LQOS6rIVpPFjLTyoKLQWY6GeTb:MQ/zAYfAfeN9UV1FPZKLQWY6G6b
TLSH 26D4236573AB5672F74628369CA4D4E7DA80323B17E44777DECA1D9036B31B23630A32
Reporter abuse_ch
Tags:cab geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm51.hanmail.net
Sending IP: 203.133.180.239
From: Park Woohong <dongsanbang@daum.net>
Subject: 견적요청_아인테크_20210222
Attachment: G0170-PF3F-20-02602T.cab (contains "Ed6yzOJs1Nzhq0N.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.15994.30809.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/211825b15c064794fb1b8201797bf03e089a261116d5ea5aa944cbaadcc63a14/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 07:22:16 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eemclmk4azdzj6y3qiaxs67qhyejujqrc3k6uwvjitf2vxgghika._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 211825b15c064794fb1b8201797bf03e089a261116d5ea5aa944cbaadcc63a14

(this sample)

Formbook

Executable exe 92737036f323b1c72064c1e8038a942266435048a3ce4847f7e5b29558376c1c

  
Dropping
MD5 8a2c7a9564d3382a6627d50b061f2d78
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92737036f323b1c72064c1e8038a942266435048a3ce4847f7e5b29558376c1c

Comments