MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40
SHA3-384 hash: a735e93f706d4a547b61c37e3d08cc21acbfa96435a4849199d02d8e0df28236f2f1741738e494fc938fa3ca50e3acf9
SHA1 hash: 7a3fe0360c26c421771ab4cf54d92b6daa0d7947
MD5 hash: e905ec18f06a7bd0a1eb1a48b9b07617
humanhash: fifteen-burger-quiet-freddie
File name:G0170-PF3F-20-02602T.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:597'233 bytes
First seen:2020-12-29 08:00:00 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:hyvtIrTUavoWu3qQgMbq/nxbKgK6BRcImjm4rLpVzpMZpwjjw6YIAO4kEfeE7:GeLvj8g6Kn13BGFj3vfpMI3w6YILhEfT
TLSH F1C423F0C9973212D63D6A46E5ACF99B94AFC2D71293C3492135B62F01FDF0D6680A4D
Reporter abuse_ch
Tags:cab FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail-smail-vm47.hanmail.net
Sending IP: 203.133.180.235
From: 이상훈 배상 <kny3940@daum.net>
Subject: 요청자료목록
Attachment: G0170-PF3F-20-02602T.cab (contains "List.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.494.14111.23090.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffjsiiybquwjm44sxpgkx2ghbyz4fwp2yvboeadgvpkohvdmjvaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 2953242301852c967392bbccabe8c70e33c2d9fac542e20066abd4e3d46c4d40

(this sample)

Formbook

Executable exe 699ca93661e2c1ba5dc75fa4c7041b23a4d24ebd9de3b5bdc6a0876863d00ea8

  
Dropping
MD5 3feaf8affbc4b67a601e2db562ef348b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 699ca93661e2c1ba5dc75fa4c7041b23a4d24ebd9de3b5bdc6a0876863d00ea8

Comments