MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f0cfbc9890223502169ef67256a9731d803fedddd3be2b28bc8289f425d8078. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f0cfbc9890223502169ef67256a9731d803fedddd3be2b28bc8289f425d8078
SHA3-384 hash: a56b89e14b1413534dfcbec22c275f5a3744ea5cb1252764a9ce45e0f4b26a251ad39a53829f2d35abcbae0860505cdd
SHA1 hash: 842397d8e9af5dc09ad6ff26026b9e331235b49d
MD5 hash: 850944c199843d039390a1357c761e60
humanhash: wolfram-cold-foxtrot-beer
File name:010-116.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:408'156 bytes
First seen:2020-10-17 06:35:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:6c0D39dBYkfRxvqYBS9MPceYNIh66Rpp/GzvDftS8gji+ZnciKha8u:qDt3frvqwcSEEp1Ujtpg/ethan
TLSH 759423BC8AF7B050DB2564E9E24FB5108612DFB20A5DF267F10F780D6B40228CA25BCD
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.bur-ibserte.com
Sending IP: 45.95.169.122
From: Account <info@bur-ibserte.com>
Reply-To: Account <mail.reply@mail.com>
Subject: ORDEN
Attachment: 010-116.zip (contains "010-116.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.38266.25719.23132.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f0cfbc9890223502169ef67256a9731d803fedddd3be2b28bc8289f425d8078/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 08:43:18 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h4gpxsmjairvailj55tsk2uxghmah7w53u56fmulzauj6qs5qb4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3f0cfbc9890223502169ef67256a9731d803fedddd3be2b28bc8289f425d8078

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3f0cfbc9890223502169ef67256a9731d803fedddd3be2b28bc8289f425d8078

(this sample)

Formbook

Executable exe b791ce91936d65f90d9ca761c1999ea8330b66d3c3aede92564395d4778b5955

  
Dropping
MD5 4b55cb7e5402691815a7b61d3c2a1ff8
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b791ce91936d65f90d9ca761c1999ea8330b66d3c3aede92564395d4778b5955

Comments