MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43c699fca140940200a40544062c0ab3ed3421d8eebd53377c2576380ac0ba77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43c699fca140940200a40544062c0ab3ed3421d8eebd53377c2576380ac0ba77
SHA3-384 hash: 015924946c6a9ac2d1b6d99cd50c100c5b130afc270a46ca2af697b44d09514a9e47d76a0c113e1d305cebe4f86e9408
SHA1 hash: 0573438558d2ebec6c765d19ff3b47c86354f049
MD5 hash: 5911b7c858a353a52dc2fc1c0fe77d23
humanhash: nebraska-lamp-blossom-bacon
File name:R900071030.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:247'980 bytes
First seen:2021-01-05 09:37:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:AWMX6qYbZDjBRot5saOEPpgeHx6+TICpoqIBF:ArbYBUaDE0+sCpM
TLSH C0342374AC81B3C215AB91708908A30E24AB7A367C68CC397121BB57EDDFBD757CC945
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Sawit-Tech Power Sdn Bhd <mytan@sawit-techpower.com>
Reply-To: mytan@sawit-techpower.com
Subject: R900071030/RFQ/SAWIT-TECH POWER
Attachment: R900071030.rar (contains "R900071030.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43c699fca140940200a40544062c0ab3ed3421d8eebd53377c2576380ac0ba77/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2021-01-05 09:38:07 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ipdjt7fbickaeafeavcamlakwpwtiioy526vgn34ev3dqcwaxj3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/43c699fca140940200a40544062c0ab3ed3421d8eebd53377c2576380ac0ba77

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 43c699fca140940200a40544062c0ab3ed3421d8eebd53377c2576380ac0ba77

(this sample)

Formbook

Executable exe 53878a7b306a51e03f35297ea81e42c7aa079665928f8ca0d1f1732c0da82ffe

  
Dropping
MD5 bdd3c5a289dcb8534f5371814b853e7e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 53878a7b306a51e03f35297ea81e42c7aa079665928f8ca0d1f1732c0da82ffe

Comments