MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79f835f49f5cb82f5f1f36f03829eec12ecb5bf06c38fd96d7bbae33e18d9171. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79f835f49f5cb82f5f1f36f03829eec12ecb5bf06c38fd96d7bbae33e18d9171
SHA3-384 hash: 79c688da4504693bb42cd3cd9491c5e5a5f1dd06e57d4d6e598112282fc78e6ab55643f901e5dcaa8944713df1365ea3
SHA1 hash: cb37a68fd042dcb7f07af359154511da4a709e3b
MD5 hash: 80876be009e51b5d5292487e09460830
humanhash: berlin-red-kilo-louisiana
File name:20210113.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:270'358 bytes
First seen:2021-01-13 20:12:33 UTC
Last seen:2021-01-20 16:30:31 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:i3UwDxDwEV66tYTViOiiR6uvfn+OYITDPJZyA4TDh17ZSTVb+caZ:i3UwDxMEV66aTVaiE6fn+OBjiDT9VZGy
TLSH 034423AC222DF583CF077A3369A285B50A2C5ECD8546DAB8E4D43577297EB5050ECE3C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.allaboutoffice.gr
Sending IP: 94.130.138.183
From: compras <compras@improvengsrl.com>
Reply-To: compras <infotec@2trom.com>
Subject: TRANSFERENCIA
Attachment: 20210113.zip (contains "RRW9901200241.exe")

Intelligence

File Origin
# of uploads :
8
# of downloads :
157
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.13110.20594.UNOFFICIAL
Create hunting rule

Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79f835f49f5cb82f5f1f36f03829eec12ecb5bf06c38fd96d7bbae33e18d9171/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:13:13 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ph4dl5e7ls4c6xy7g3ydqkpoyexmww7qnq4p3fwxxoxdhymnsfyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79f835f49f5cb82f5f1f36f03829eec12ecb5bf06c38fd96d7bbae33e18d9171

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 79f835f49f5cb82f5f1f36f03829eec12ecb5bf06c38fd96d7bbae33e18d9171

(this sample)

Formbook

Executable exe 546e873e9e746eeee9cbed391ff7463ce192091ee0ff51c076291da5d836f64f

  
Dropping
MD5 61ffb4ad4721f51413075923b2e9468d
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 546e873e9e746eeee9cbed391ff7463ce192091ee0ff51c076291da5d836f64f

Comments