MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53bb3aff8246b56bbdf1dcae822745334973509d397e30a61f54ad45d6e3d95b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53bb3aff8246b56bbdf1dcae822745334973509d397e30a61f54ad45d6e3d95b
SHA3-384 hash: 45dff5a02c71956439b20761806d84511af58431b1300097e834b226034a7f63fd38df48e59928f69d48e37baf4e04b2
SHA1 hash: f018623f26fffb1e6c6f22505e4e13894ebe00ec
MD5 hash: 60cb31774e71b9ca02573a3b92409dc5
humanhash: earth-victor-chicken-berlin
File name:10-17-2020_06-59-10-PM.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:1'095'655 bytes
First seen:2020-10-17 12:09:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:ahXm7vz4VQDNMvcCrHXUkVGtcBVjGfnN+O65PkhD0ir5VuSaz:n4aDWBjXUptYVjGfnMOukZlVXaz
TLSH E83533DEBE6FC91CF736099143B5D52D64C7DE92EFC00A01282C93A648AB161D734F6A
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: citdev.mx
Sending IP: 74.208.175.156
From: Корнеева Ирина <zakaz@mzsa.ru>
Subject: Доставка 20.10.20
Attachment: 10-17-2020_06-59-10-PM.zip (contains "offer order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

Win.Virus.Ramnit-9775603-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53bb3aff8246b56bbdf1dcae822745334973509d397e30a61f54ad45d6e3d95b/
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-10-17 11:48:18 UTC
AV detection:
38 of 48 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ko5tv74ci22wxppr3sxiej2fgnexgue5hf7dbjq7kswulvxd3fnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53bb3aff8246b56bbdf1dcae822745334973509d397e30a61f54ad45d6e3d95b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 53bb3aff8246b56bbdf1dcae822745334973509d397e30a61f54ad45d6e3d95b

(this sample)

Formbook

Executable exe 2aef6190fbec261019520c2e603024eb0abf68eaf2460b3ed7c03c14754e5a09

  
Dropping
MD5 92ce59db9a10fa135250802f6716e899
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2aef6190fbec261019520c2e603024eb0abf68eaf2460b3ed7c03c14754e5a09

Comments