MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605
SHA3-384 hash: 47dc330ae614a99c2e55a9f38d24de2e27fe6c44c3aa87a7b8d7943b40b71d1f5e8f6a167f600dc530c4356a8b923356
SHA1 hash: 811f1390779502f1be51d7917fb98cce78c1ab1b
MD5 hash: ca41b683ecbf70714772d76200f544f4
humanhash: cup-purple-september-fruit
File name:RFQ1101.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:775'834 bytes
First seen:2021-01-11 09:00:11 UTC
Last seen:2021-01-12 09:57:36 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:Z4T6dHFs9tdDe579CLOGUPlrb/GmnxKMkQIbhmNqrZpm7XOtj9MHt73etzeXWn2L:Dt+K5ELfUPlrjlKMkLdoCDma19Mxsz6r
TLSH F7F433BB51BB8E65B863E5EBF9C8292C03B4721D655C5AC3A06199F81D10AC4247CFF1
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: Daniel Gomez <biuro@zurawie.info>
Reply-To: mzahar04@protonmail.com
Subject: FW:RFQ
Attachment: RFQ1101.zip (contains "RFQ1101.exe")

Intelligence

File Origin
# of uploads :
7
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 09:00:18 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jt6zrbydakvcwphucqcdkd3vepk2gl6fsdbpd7uvak5pfxtteycq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 4cfd98870302aa2b3cf41404350f7523d5a32fc590c2f1fe9502baf2de732605

(this sample)

Formbook

Executable exe cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e

  
Dropping
MD5 522c178672d1855bf0ea66480ab732c1
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb9e52fd5d9184843d3d0a1b79e604e1c19be1a09df19c2f444632d716c30e9e

Comments