MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f5460541b1a30d89e92a3b470f9be2ef8ae3f7faa706cf8a0aa8fc974d60134. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f5460541b1a30d89e92a3b470f9be2ef8ae3f7faa706cf8a0aa8fc974d60134
SHA3-384 hash: a21f835cd08f3df170b9f29c722910dbc17ebb8ae8a6a8620e3a411fed008f5833eabe8702d691d41ea88ca6f26ac32f
SHA1 hash: 7259516737b909a2fb1ee6c32c2ee7b244b9998d
MD5 hash: 65a888da563dde64cb44fdceb7c2ee49
humanhash: undress-alanine-hamper-tennessee
File name:PO750.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:603'260 bytes
First seen:2020-12-20 08:00:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2KWeVh2gOrPqwCMDJlnonBcdo4vhGiQjFJmDVLiZfbzFAhlEiwxIx:2wVrODYiokoSQ3vmDViZHF02jIx
TLSH 3ED4231DF88CA1CD6A5AAE9D436C67D62C1DF770FB2C2B7C9B32031D8706D466E46181
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.faber-tr.com
Sending IP: 45.85.90.153
From: Midlands td<office@faber-tr.com>
Subject: Pls Qoute ,,,
Attachment: PO750.rar (contains "PO#14379 - SO#146001119375 XMAS wood land.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f5460541b1a30d89e92a3b470f9be2ef8ae3f7faa706cf8a0aa8fc974d60134/
Threat name:
ByteCode-MSIL.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-12-20 08:01:08 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n5kgava3diynrhusuo2hb6n6f34k4p37vjygz6favkh4s5gwae2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6f5460541b1a30d89e92a3b470f9be2ef8ae3f7faa706cf8a0aa8fc974d60134

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 6f5460541b1a30d89e92a3b470f9be2ef8ae3f7faa706cf8a0aa8fc974d60134

(this sample)

Formbook

Executable exe 017656cf14c2df80d45162895c9f28311beeff0fe3d8fda25cfd08e928e8c526

  
Dropping
MD5 9e2561e5e0a9a7a5dac978541cd31aad
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 017656cf14c2df80d45162895c9f28311beeff0fe3d8fda25cfd08e928e8c526

Comments