MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d8136f1660d602c3b5b97576a8ce83ca77aca4e8fdc0741caacfc0fe1533312. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d8136f1660d602c3b5b97576a8ce83ca77aca4e8fdc0741caacfc0fe1533312
SHA3-384 hash: 4eb5dbf9edff3706130dae2c11f1c54f2992632c12b5c2664c23a930dbe8688216041304e26f39f2fb96a6f2d660dfb1
SHA1 hash: 49839a4336e7cd1ed1e5c4be9ed4135e65736c66
MD5 hash: 6bc4cf4baebd3382f783e5a19cb45ba3
humanhash: helium-montana-four-apart
File name:New Order.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:195'260 bytes
First seen:2021-01-07 14:09:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:WXfMBd+0lh8kqKN0EqNtb2VdPuCGWCIzLbs2/NUZPL8myRmcxd8SComKRV2qIuc8:I8+0DPqKN0EmbmCWCIrsNZPL8mtcbedO
TLSH 8A14125CB0293C8679B4E3C5D378B294D5696F709F2C180B0AD8698352EDD727E291F1
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.123host.iq
Sending IP: 185.76.34.219
From: Mehmet Kumar <omt@co.jp>
Reply-To: tac.tacky@mail.com
Subject: AW:New Order
Attachment: New Order.rar (contains "Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.26725.28351.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d8136f1660d602c3b5b97576a8ce83ca77aca4e8fdc0741caacfc0fe1533312/
Threat name:
Win32.Worm.SpyBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-07 12:53:09 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwatn4lgbvqcyo23s5lwvdhihstxvssor7oaoqokvt6a7yktgmja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3d8136f1660d602c3b5b97576a8ce83ca77aca4e8fdc0741caacfc0fe1533312

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3d8136f1660d602c3b5b97576a8ce83ca77aca4e8fdc0741caacfc0fe1533312

(this sample)

Formbook

Executable exe ee8ac19b40be65306741e69e41cc3768e469fedd9a55b8a1ff3a24723f6fd6da

  
Dropping
MD5 2c70b05c931e9d4c5a419fbbfa036ce5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ee8ac19b40be65306741e69e41cc3768e469fedd9a55b8a1ff3a24723f6fd6da

Comments