MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 842c3fe91dbb02d5923cee2089de26e3f91833eb72e816db8c8fb3d12c495f66. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 842c3fe91dbb02d5923cee2089de26e3f91833eb72e816db8c8fb3d12c495f66
SHA3-384 hash: 32f4c8c777dd9802a28837ad9c9ccf5a57ef75d77a910404101ffaa2f7973617d9f93ba56dbc4ab6df273333631d3152
SHA1 hash: bd59f9923d5ddb47808028658abb69bd3da0b65b
MD5 hash: 523f3cf9374c292451686f5103856be6
humanhash: avocado-west-jupiter-eleven
File name:Company Updated 27% Discount Prices With Details And Spec..rar
Download: download sample
Signature Formbook
Create hunting rule
File size:370'420 bytes
First seen:2020-10-13 05:57:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Shojf3R1orJbtt49E8ZGC0Hn8j25TZR4L5mSgfq/VNk+Ncj+9dqHNv/WH1gowP:IoDR1abtt4ObCmnPKgC/V+WcjadqHNH5
TLSH 8974238904505854BB71FA3F630181ADC5FB02794989F9E3FEE3F21D25AE3399525A33
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.kingcrete.com
Sending IP: 68.66.231.155
From: t.bashir@kingcrete.com
Subject: Re:Re: Company Updated 27% Discount Prices With Spec.
Attachment: Company Updated 27% Discount Prices With Details And Spec..rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/842c3fe91dbb02d5923cee2089de26e3f91833eb72e816db8c8fb3d12c495f66/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 02:01:14 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqwd72i5xmbnler45yqitxrg4p4rqm7lolubnw4mr6z5clcjl5ta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/842c3fe91dbb02d5923cee2089de26e3f91833eb72e816db8c8fb3d12c495f66

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 842c3fe91dbb02d5923cee2089de26e3f91833eb72e816db8c8fb3d12c495f66

(this sample)

Formbook

Executable exe 6841a00603c067163259e142990659c0217ded69e2895d187fa65f9439034c7f

  
Dropping
MD5 7f216d03c0fbeb51a7150e37bdc3c668
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6841a00603c067163259e142990659c0217ded69e2895d187fa65f9439034c7f

Comments