MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53e3ae371a3e329c6ed4942eb6cc51007c53008e3b9da6fccaecbed8f68f2ffa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53e3ae371a3e329c6ed4942eb6cc51007c53008e3b9da6fccaecbed8f68f2ffa
SHA3-384 hash: a6102a3d4b3771dd777cc963505bbca6586b74e91daef8b787da12a432d17b78fdd2a0e429edf051a170c524db1d813b
SHA1 hash: 83923ef6f729ee95fe5157b77cc685b349bae66b
MD5 hash: cc3d97d3435e0701496ec3d589cc3651
humanhash: oklahoma-comet-high-vermont
File name:(RFQ)2.1 본설비(내역서_울산LNG)_(137507B).img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2021-03-02 07:55:14 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:qR3mQbbmNRxegofI2vrqjVJnj/7luYoUbLB4N68p:MmNRxeg2TTqpFc3dN
TLSH 6145BE3A23D51BA4E57CDB3952A0212147F1B903E333C76A3DEC12C9DB91E895633B66
Reporter abuse_ch
Tags:FormBook geo img KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.ecomotorhk.com
Sending IP: 162.144.56.225
From: 서진효 <jinhyo.seo@daewooenc.com>
Subject: [울산북항 LNG PKG]Request for Quotation_터미널 1단계 LNG Package 건설공사
Attachment: (RFQ)2.1 본설비(내역서_울산LNG)_(137507B).img (contains "(RFQ)2.1 본설비(내역서_울산LNG)_(137507B).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.17987.642.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53e3ae371a3e329c6ed4942eb6cc51007c53008e3b9da6fccaecbed8f68f2ffa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpr24ny2hyzjy3wusqxlntcrab6fgaeohoo2n7gk5s7nr5upf75a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/53e3ae371a3e329c6ed4942eb6cc51007c53008e3b9da6fccaecbed8f68f2ffa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 53e3ae371a3e329c6ed4942eb6cc51007c53008e3b9da6fccaecbed8f68f2ffa

(this sample)

Formbook

Executable exe 5d7395d4e9aecd39c3b6944843d929dd3cb27bbf2e97674c4b28b56239d6a89b

  
Dropping
MD5 8a2f2485a76cd1d324c6fc1241caa503
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5d7395d4e9aecd39c3b6944843d929dd3cb27bbf2e97674c4b28b56239d6a89b

Comments