MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248
SHA3-384 hash: a725e75474497cf8fd74d0955a0f05318e1c1a54db372d3d0271a235ad3f9b9baf8fa7c242d065655c6dc260d8e4d1ee
SHA1 hash: 0db061650dc7c52e97c436d60094d6b9a4632ee1
MD5 hash: c3abbbcb8910ed7bdb17023d4a7dad9a
humanhash: sink-paris-november-massachusetts
File name:payment_doc.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:564'007 bytes
First seen:2021-01-19 07:23:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:4p/uAUpUeftP7hlXgo4saKY3GP9TKCwMyh7SmW23sF:THNtrXtaKUGlSTh7PBo
TLSH 56C423DC526C9327D9B3FFA2422920C654EF341B619E42F028D1546AD2642BE91FE3F7
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.sopharma.com.ua
Sending IP: 77.123.131.108
From: Aliya Tulemissova <a.tulemissova@sopharma.kz>
Subject: Payment form for Contract101
Attachment: payment_doc.rar (contains "payment _doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.11201.7511.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:24:15 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ouwjgm4uycaouzt2dueyyyb2oilmc3g7wk5okfwxrifowfcugjea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 752c933394c080ea667a1d098c603a7216c16cdfb2bae516d78a0aeb14543248

(this sample)

Formbook

Executable exe ad03ca16b05c593894d3cf90ea6ebe56f3ce6dc94dc0675234f357893f3aadfa

  
Dropping
MD5 d65c9fe128d2294055cc9b3238e67c07
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad03ca16b05c593894d3cf90ea6ebe56f3ce6dc94dc0675234f357893f3aadfa

Comments