MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24ace8a4efd35e74e0dda45103e679a121de60ee3b7d59fa8e75ff91c3573d1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24ace8a4efd35e74e0dda45103e679a121de60ee3b7d59fa8e75ff91c3573d1e
SHA3-384 hash: d786d20d8e1b4922f3a38108e4149ce5b7f89b840f7299e7540848d623a9f382540193764f27b20de9922af34abe5552
SHA1 hash: c0758f4a5faa07f410f36393b1b3caa6dfae8e48
MD5 hash: 02ed0d1a602e8c40d374fecfac443a54
humanhash: spring-william-mountain-carpet
File name:RFQ.Offer Required-Urgently.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:568'934 bytes
First seen:2020-10-09 06:28:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JqvbQf/3Sx4MR37z4vXw1K8P1AZ1KT4F0twHbx5w0/dTOhUuv2N:YjQfPXGLz2oT4it2x5wsGi
TLSH C4C4232BEA2D7B5B11C5D5CA3B08E9F01B7EC1B442CEEE4A14548F4E7E1207886CA537
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: nahmad@olayandescon.com
Subject: rfq Offer Required Urgently
Attachment: RFQ.Offer Required-Urgently.rar (contains "10008003 NA-HRI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24ace8a4efd35e74e0dda45103e679a121de60ee3b7d59fa8e75ff91c3573d1e/
Threat name:
ByteCode-MSIL.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 06:00:30 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=esworjhp2nphjyg5uriqhztzueq54yhohn6vt6uoox7zdq2xhupa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/24ace8a4efd35e74e0dda45103e679a121de60ee3b7d59fa8e75ff91c3573d1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 24ace8a4efd35e74e0dda45103e679a121de60ee3b7d59fa8e75ff91c3573d1e

(this sample)

Formbook

Executable exe 6fb6937cf1cdf0d1c89ba807e43754a2d06754cd820992dc0b91cb61540cf547

  
Dropping
MD5 42a13638ebf12f6bb46afc243ecc6e47
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fb6937cf1cdf0d1c89ba807e43754a2d06754cd820992dc0b91cb61540cf547

Comments