MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f9e6aa84a6f54195f78cda6a39fa08106dd45b89480fe5d95a9632056e199d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f9e6aa84a6f54195f78cda6a39fa08106dd45b89480fe5d95a9632056e199d2
SHA3-384 hash: c5e773403f410b32db0d9bce3cd132f8c78ab11b53b3f1b20fe44d15e467b0e490137c7ce9509e3625275bbd1205ad46
SHA1 hash: 91655228ec0516fe54dfd0ef5aa5270295b9d6b1
MD5 hash: f2a2ce55869a70c92a4f3d02100e6ddb
humanhash: johnny-fruit-monkey-march
File name:RFQ..arj
Download: download sample
Signature Formbook
Create hunting rule
File size:639'250 bytes
First seen:2020-10-07 10:46:54 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:39p9sNZuzjKcmkpEXbPpaglCyEr0nZhtfNalLrFu5Lk4595PVcNjz27JEZl:3b6OKcmkpEHkyEr0nZhdMlLEk4sNnkJw
TLSH 1DD423BB4155622AF75EC4EE570B52088B242EE7F315098EB6FFD96B0B2300196B3C35
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: serve0.postalshipment.info
Sending IP: 192.119.92.221
From: Lena Al Yousaif <postalshipment.info>
Reply-To: ongsuknadi@gmail.com
Subject: Request For Quotation
Attachment: RFQ..arj (contains "RFQ..arj.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f9e6aa84a6f54195f78cda6a39fa08106dd45b89480fe5d95a9632056e199d2/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-07 10:07:14 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6pgvkckn5kbsx3yzwtkhh5aqedn2rnyssap4xmvvfrsavxbthja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5f9e6aa84a6f54195f78cda6a39fa08106dd45b89480fe5d95a9632056e199d2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 5f9e6aa84a6f54195f78cda6a39fa08106dd45b89480fe5d95a9632056e199d2

(this sample)

Formbook

Executable exe 4ab3ba278dacd218a4308aa0074105546a52256e029a29d67f8291facf25fd43

  
Dropping
MD5 39265cf3c56c40c255794a65fbf37499
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4ab3ba278dacd218a4308aa0074105546a52256e029a29d67f8291facf25fd43

Comments