MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4060e23bed741b111e9e0dd60254ad25c4fb71075dbe73c7471d1c716d850c3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4060e23bed741b111e9e0dd60254ad25c4fb71075dbe73c7471d1c716d850c3f
SHA3-384 hash: 849a1fe742ae9abd26371fc2f3c2124840f00a1b706477b4141bae063d86b6996449db5c96ebb994c0734523155e9998
SHA1 hash: 5692ccfe31d202981c9f8be4ec116996b2ed6d47
MD5 hash: fd183cbffcca11e5fccfe9b3f6fc3460
humanhash: jig-maryland-california-vermont
File name:MV HARMONY SW_0000045_pdf.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:443'698 bytes
First seen:2020-08-05 09:29:15 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:kdBwc8Fbdx/hwMJ/xAVnXCrN5Y+yrIKOLfw6UNEXrx:kbgFbrAVnQ5KEfw6UNux
TLSH 7E94238B2CB60C30D3DCED24D4495F1EA62BC5BA3294855D5F3CA9360FF5AC22488AF5
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lucky.mydomainhoster.com
Sending IP: 103.98.237.92
From: "POHANG SHIPPING CO.,LTD." <pohang@pohangshipping.com>
Reply-To: pohanq@pohangshipping.com
Subject: Overdue Payment
Attachment: MV HARMONY SW_0000045_pdf.arj (contains "MV HARMONY SW_0000045_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4060e23bed741b111e9e0dd60254ad25c4fb71075dbe73c7471d1c716d850c3f/
Threat name:
Win32.Trojan.LokiBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:31:04 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ibqoeo7noqnrchu6bxlaevfnexcpw4ihlw7hhr2hduohc3mfbq7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4060e23bed741b111e9e0dd60254ad25c4fb71075dbe73c7471d1c716d850c3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 4060e23bed741b111e9e0dd60254ad25c4fb71075dbe73c7471d1c716d850c3f

(this sample)

Formbook

Executable exe c8b1244a4aa61a5efc1d6ced3ae0407111574eda81cbe9f01f269e5fae9bf4b5

  
Dropping
MD5 aa6073912bbf760550b1df1c4153fc8c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c8b1244a4aa61a5efc1d6ced3ae0407111574eda81cbe9f01f269e5fae9bf4b5

Comments