MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bcd874689d3a87ce744fb41d68ec64e7e8f65312b6c71d8dcc312780bca4800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bcd874689d3a87ce744fb41d68ec64e7e8f65312b6c71d8dcc312780bca4800
SHA3-384 hash: 5cb912bb9a45439a943225310e3bb19117a7ff6b4f26395d2f4c27d53963a43f80fada8d0d5be511cab7ea2a3841846e
SHA1 hash: d4300c8f5ed36d104f03129effc9e7ee052f4351
MD5 hash: 4c9d812b6add3a8794aa98891a25b2b9
humanhash: utah-sixteen-football-yankee
File name:Shipping doc_B-Landen.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:316'169 bytes
First seen:2021-04-11 07:44:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:ld1F1kZ7xUOIznA6iLdbGD/PvMQKZS84caxgSlem/kHkv4pZIaa:9HAIDidbGDPfKc84caxLleOMSPaa
TLSH 646423ECCBAE939AA4F1827025EB88787C295ECD7A146DB50D63B4475FDB28F1D13840
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hosted-by.rootlayer.net
Sending IP: 185.222.57.152
From: <sales@sulaihi.com>
Subject: Export Invoice for Order No : PIEX310113978
Attachment: Shipping doc_B-Landen.rar (contains "Shipping doc&_B-Landen.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6bcd874689d3a87ce744fb41d68ec64e7e8f65312b6c71d8dcc312780bca4800/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-04-11 07:45:11 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=npgyoruj2ouhzz2e7na5ndwgjz7i6zjrfnwhdwg4ymjhqc6kjaaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6bcd874689d3a87ce744fb41d68ec64e7e8f65312b6c71d8dcc312780bca4800

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 6bcd874689d3a87ce744fb41d68ec64e7e8f65312b6c71d8dcc312780bca4800

(this sample)

Formbook

Executable exe 680d5f98cd089a73e5902b3ff4e91511430c2a2c07cde11b44882fbcde670395

  
Dropping
MD5 d3cda706accb4aa2a3ad289319105464
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 680d5f98cd089a73e5902b3ff4e91511430c2a2c07cde11b44882fbcde670395

Comments