MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32fb91f4e3bb00a4a6e7b14099029cf4d6858f8ae516fd221c319baf1d037474. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32fb91f4e3bb00a4a6e7b14099029cf4d6858f8ae516fd221c319baf1d037474
SHA3-384 hash: 00aedd2fb93284699461548c04940f4d29e4f32a1710df3d9570b6381b38911971b4bbfdf241e22c23c629ae30f411f8
SHA1 hash: 0e289f640d557d5eb48688351a8a122604ac9cd7
MD5 hash: 7e73c8f7116fce41900371dbf8c19c52
humanhash: friend-fifteen-lion-april
File name:pertanyaan pesanan 2.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:335'481 bytes
First seen:2021-01-18 09:43:10 UTC
Last seen:2021-01-18 11:16:03 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:gLaEWA1t6PKD5Z0L9RO1lBPLvKqraTQdZBLQs98/eQS3DdEsDb0GmpF0X:gORAL6PCaDO9TvbraT6BXh3DTDwGmLo
TLSH 826423955BABA7EE1D2EB075C085CC408A29CDB2684C3FD0E5D866413D957D1FBB08CE
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: AKBAR AGUNG <umar@amb-indonesia.co.id>
Reply-To: umar@amb-indonesia.co.id
Subject: Re: pertanyaan pesanan#18/01/2021
Attachment: pertanyaan pesanan 2.rar (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/32fb91f4e3bb00a4a6e7b14099029cf4d6858f8ae516fd221c319baf1d037474/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 09:44:06 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
20 of 28 (71.43%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gl5zd5hdxmakjjxhwfajsau46tlild4k4ulp2iq4ggn26hidor2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/32fb91f4e3bb00a4a6e7b14099029cf4d6858f8ae516fd221c319baf1d037474

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 32fb91f4e3bb00a4a6e7b14099029cf4d6858f8ae516fd221c319baf1d037474

(this sample)

Formbook

Executable exe adc10139a3870919bf60c4345f1e9d09eec3c590a434e761c55ff3da112e9a68

  
Dropping
MD5 59f1d68e7d7425a82b9fe1a3ff2dd295
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 adc10139a3870919bf60c4345f1e9d09eec3c590a434e761c55ff3da112e9a68

Comments