MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cfd5989484e77ecc72344e68c9af1467a63cff9911d78d395c3199e5cd40f61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cfd5989484e77ecc72344e68c9af1467a63cff9911d78d395c3199e5cd40f61
SHA3-384 hash: e808c392f0b0026d7442be6231c01da94f88009ade7fd912c106ecbcc9b83570e484eeb8ec868f4370354be9e657c133
SHA1 hash: d4bf5b97f4dd99ab0d4b26b0f8d0eb2e3ea6dee2
MD5 hash: d06f461cbf6a3d8490299f9a6866eb0f
humanhash: mirror-uniform-arizona-earth
File name:RFQ Specification BINIF0865.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:602'041 bytes
First seen:2020-10-21 07:00:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:jBA3JRgAeFUpTyS/fXCxuhgNyfDe93OTYbv6NZVwUgYRVd7h5:jq3YFUpR/fXCx0Syfg+TYr6NPwUgCrd5
TLSH 51D423C7D84C1145E8A1C6AE1D55583D762762A0B9C0B83F8CD61CE4A7D9C9C23FE3AE
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.naironair.xyz
Sending IP: 138.68.237.164
From: Amacon Makgoka<amacon.makgoka@hotmail.com>
Subject: Re: 回复: Request for Quotation with reference: BINIF0865
Attachment: RFQ Specification BINIF0865.rar (contains "RFQ Specification BINIF0865.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cfd5989484e77ecc72344e68c9af1467a63cff9911d78d395c3199e5cd40f61/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-20 17:15:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ht6vtckijz36zrzdittizgxriz5ght7zseoxru4vymmz4xgub5qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3cfd5989484e77ecc72344e68c9af1467a63cff9911d78d395c3199e5cd40f61

(this sample)

Formbook

Executable exe 59be3e15ddff51758d23796f5528e93ff6c5164486bd0416ff25dc0ddc33f29c

  
Dropping
MD5 2277b9f854d6236cd376707afbfc3ae5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59be3e15ddff51758d23796f5528e93ff6c5164486bd0416ff25dc0ddc33f29c

Comments