MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68d1d01da9a81eb61256b631c13dbc4c30b49b54fdb1e765028b4325e4e4479f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68d1d01da9a81eb61256b631c13dbc4c30b49b54fdb1e765028b4325e4e4479f
SHA3-384 hash: b1d564699756949cfdd82893db644bcdd4cf9ded6a1182b3faed62164286ecffc9e17ecb432daa3eec428465d3225332
SHA1 hash: c2f09bff2c12999063f71ed47e6366a267477911
MD5 hash: afa6e5998806fb2333354cedc0fbf0e5
humanhash: texas-south-maryland-earth
File name:Quotation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:390'097 bytes
First seen:2020-10-26 13:36:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VUqB9vYulsfwSqA/GqyxBs+8ae5P0H/hxHXRZ+WhnaaCocrCja8e93f:BYGsBNOxBszaeVgx3RMW5KzmjaT3f
TLSH 8D842305150256FA1D331D9F321F2A72BDC6D0CCEC7D42EAD1A42DE6AF366492C48AB3
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: msa-smtp1.hinet.net
Sending IP: 168.95.6.52
From: <danny-feeder@umail.hinet.net>
Subject: RE: Italy || Quote our Different Designs
Attachment: Quotation.rar (contains "Quatation0000000000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68d1d01da9a81eb61256b631c13dbc4c30b49b54fdb1e765028b4325e4e4479f/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Suspicious
First seen:
2020-10-26 02:41:58 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 68d1d01da9a81eb61256b631c13dbc4c30b49b54fdb1e765028b4325e4e4479f

(this sample)

Formbook

Executable exe ef4c04da2b5fe6ce33597d1dbe44a8b84b156cb1bd03b3a3f8d8c9dabede075b

  
Dropping
MD5 be489841f4f228494554e10c55bbe3dc
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ef4c04da2b5fe6ce33597d1dbe44a8b84b156cb1bd03b3a3f8d8c9dabede075b

Comments