MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147
SHA3-384 hash: 8b9014d398ba6dd8c9a17f42983d63074d7e3f1cc937e3a65edce4b5b846967861b3f62491e5bf99268b86a0f9b8e33d
SHA1 hash: 54a61f4cfafe48d6f9e9c291adf4bba11cbce105
MD5 hash: c097066605216043148a3e8eca3a1abd
humanhash: sad-bacon-blue-equal
File name:180120211200.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:805'411 bytes
First seen:2021-01-18 08:34:32 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:vaFFW1aTCPcdwx0pw7MzU7Ct7Tknd6gsoZLMYLB7IUr6Whtn:vaF0ITKRCe7MdQdnBMYLB7I26Y
TLSH B00523159E93D51D49AB0BD059C49A3531B476B13112708FB3BBAA8CC037FFA3A2D16E
Reporter abuse_ch
Tags:cab geo KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail-smail-vm49.hanmail.net
Sending IP: 203.133.180.237
From: 민상윤 <msy8033@daum.net>
Subject: 설계서 및 견적서 요청에 관한 건
Attachment: 180120211200.cab (contains "180120211200.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.generic.ml.11684.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mce4fj5vhcdtrnz34uxbxjdstjo7yzsb3iz3frolvi2mtmtykfdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 6089c2a7b5388738b73be52e1ba4729a5dfc6641da33b2c5cbaa34c9b2785147

(this sample)

Formbook

Executable exe 29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183

  
Dropping
MD5 293b5da09841ae1984a6478fd3caaf24
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29f154b8c244af71ad5dda7bee1e41896e78cf7e5f189219754962c10bcd4183

Comments