MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51fb9b5d18024da76ab74d7f21eb0c8d0d278d01b4e6f96f3d0d4187bedd5a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51fb9b5d18024da76ab74d7f21eb0c8d0d278d01b4e6f96f3d0d4187bedd5a36
SHA3-384 hash: a7d818e9996417495761b5b96cee7b2d3dedc1fbda76fd3cb82f54b291b8ae7b8f795c3ba47b0f3f4ee06c1f189c6b06
SHA1 hash: f29b006dc7d7c65ad194bd3ad09d24a2409bba31
MD5 hash: 12a489331601b8fb523274b4f9220395
humanhash: nineteen-one-illinois-wolfram
File name:Request for Quotation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:592'030 bytes
First seen:2021-01-19 07:37:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:f+HAVVhJNMY8xKWUB2Ihqf/haCXv4huuMI/OXRzCX/WAayoD:eokxKJcx8CXvc6tCXqyoD
TLSH 42C42330F925A5BBB53F56FF41F2AD9B55A2822B828441ED7AF2F80B07C036C511D719
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dynabiotech.cam
Sending IP: 111.90.158.99
From: Mesut <mesut@alamsteel.com>
Reply-To: andypurchesmen.780@gmail.com
Subject: Quotation NEW ENQUIRY ///URGENT///
Attachment: Request for Quotation.rar (contains "Request for Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51fb9b5d18024da76ab74d7f21eb0c8d0d278d01b4e6f96f3d0d4187bedd5a36/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:38:16 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kh5zwxiyajg2o2vxjv7sd2ymrugspdibwttps3z5bvayppw5li3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/51fb9b5d18024da76ab74d7f21eb0c8d0d278d01b4e6f96f3d0d4187bedd5a36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 51fb9b5d18024da76ab74d7f21eb0c8d0d278d01b4e6f96f3d0d4187bedd5a36

(this sample)

Formbook

Executable exe ae8f3d13092dbd9ac0a490c691eefafe0026e44148a9df896d6b5b8edceb5284

  
Dropping
MD5 7f2ab7a73897ef184b2b2f88c441f7b2
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae8f3d13092dbd9ac0a490c691eefafe0026e44148a9df896d6b5b8edceb5284

Comments