MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 910063448e7fe4744540ab1c63efcc39dc09847b199be2fb95734859e0106800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 910063448e7fe4744540ab1c63efcc39dc09847b199be2fb95734859e0106800
SHA3-384 hash: f63fc8788096cf187f4e27b4af549f319547b1dcd86c27d84e60c41efa55b303a4bbe96207760ac3f944f83121af200a
SHA1 hash: 79fa5796a4eb13d31565a67a3bd7cbb47f86460d
MD5 hash: e62e70b5077a75d79ae9ac842a0cd513
humanhash: sweet-snake-pluto-kansas
File name:訂單確認.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:370'365 bytes
First seen:2020-10-13 08:04:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:nAtNTT/xip0Jv604uzUtftNrCFL3WvoWvIAyRGXm1mxzHmICNQFrlhJCO3qDlNOC:AtN3/8CJv6VuzStNmxWvoWX8GFtG9WFe
TLSH C574234EE6E1B0C35B3FB52489DD8B362922C68C535A011156CEEF83F9CE7A64F19790
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: qq.com
Sending IP: 183.3.255.186
From: Peipei <peiyang@greentopiachina.cn>
Subject: RE：訂單確認
Attachment: 訂單確認.rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/910063448e7fe4744540ab1c63efcc39dc09847b199be2fb95734859e0106800/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 07:44:22 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/910063448e7fe4744540ab1c63efcc39dc09847b199be2fb95734859e0106800

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 910063448e7fe4744540ab1c63efcc39dc09847b199be2fb95734859e0106800

(this sample)

Formbook

Executable exe 6d793847fa7272019425c00c17e6f84f719a74a926219a6f6a9c7d96f033fc48

  
Dropping
MD5 f29c9c2fa173142978d0620765043f21
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d793847fa7272019425c00c17e6f84f719a74a926219a6f6a9c7d96f033fc48

Comments