MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bd049cc0b0186159866586cf45e897f4ca6f2bd724dd244ebbc54e2a99f2b22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bd049cc0b0186159866586cf45e897f4ca6f2bd724dd244ebbc54e2a99f2b22
SHA3-384 hash: 5d0eb6c2423013a4ac73577387641bee5a90e17c56db02ea3ef33cda417760a690213c5a0314615d43fbaf17aff6d1e0
SHA1 hash: 4cf4bfe12ff786c603dde9da81ab10f53810c663
MD5 hash: fa968be3b49afa38c035d0e36b7385ae
humanhash: winter-music-aspen-thirteen
File name:Shipping Document PLBL Draft.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:300'654 bytes
First seen:2021-02-18 08:42:51 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:4lCyfS9s4YFC6DaN16/BgSHquv53PgOGUG7/ikG4gPHdEtTKa3Gu:EHfEs4YFC5u7xPxG7WjPytTKQGu
TLSH B054231BF200B78ADE34F5F6BC5030C534A213673B98A5DA22DDAC59942D8F51B7D88E
Reporter abuse_ch
Tags:FedEx r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: nl0.bnjo.gq
Sending IP: 159.89.24.190
From: FedEx Forwarding <support@fedex.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Shipping Document PLBL Draft.r00 (contains "Shipping Document PL&BL Draft.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3bd049cc0b0186159866586cf45e897f4ca6f2bd724dd244ebbc54e2a99f2b22/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-02-18 05:27:42 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hpiettalagdblgdglbwpixujp5gkn4v5ojg5erhlxrkofkm7fmra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3bd049cc0b0186159866586cf45e897f4ca6f2bd724dd244ebbc54e2a99f2b22

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 3bd049cc0b0186159866586cf45e897f4ca6f2bd724dd244ebbc54e2a99f2b22

(this sample)

Formbook

Executable exe f46c3e1152437fbff901cad6cf094298b5e1578a15d204993d715a936e7f501c

  
Dropping
MD5 b2238c351ed41a67f444ea0c119d957d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f46c3e1152437fbff901cad6cf094298b5e1578a15d204993d715a936e7f501c

Comments