🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92a841c1968bcbb08c081fa2df12d16e4a8011a49600c501cc49ffbe9360e8d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92a841c1968bcbb08c081fa2df12d16e4a8011a49600c501cc49ffbe9360e8d5
SHA3-384 hash: 78aea808b6cab59332c94561f9ba2f272997f122f0858262a241178cbcd1391242a926b41038ea618fb01d8ae1372d2f
SHA1 hash: e0ce17e9c81d0aee6fd6f2a0c3793a19f98708ab
MD5 hash: 2918f797cdf98fa40cf9508a43cb44b3
humanhash: tennis-football-crazy-artist
File name:07-20-2020_06-59-10-PM.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:1'095'597 bytes
First seen:2020-10-15 17:19:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:KZb1VD2AcFfgyqkq4h1DiBVjGfnN+O65PkhD0ir5VwhHYs3P:2D2AcFQ4hYVjGfnMOukZlVwhP
TLSH 1735334FFA0FE51EF91717F427B2442D8AD28D49AC4C0ED16032615AA84FB1BAB39971
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lhost7.websahibi.com
Sending IP: 213.142.131.161
From: satis@artronic.com.tr
Subject: RE:ödeme SWIFT
Attachment: 07-20-2020_06-59-10-PM.zip (contains "odeme SWIFT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

Win.Virus.Ramnit-9775603-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92a841c1968bcbb08c081fa2df12d16e4a8011a49600c501cc49ffbe9360e8d5/
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 07:41:55 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=skuedqmwrpf3bdaid6rn6ewrnzfiaenesyamkaomjh735e3a5dkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ramnit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92a841c1968bcbb08c081fa2df12d16e4a8011a49600c501cc49ffbe9360e8d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 92a841c1968bcbb08c081fa2df12d16e4a8011a49600c501cc49ffbe9360e8d5

(this sample)

Formbook

Executable exe 199533f77cb4331908a90346f24610888ef42d6dd2f9866b733752426702e737

  
Dropping
MD5 586e761b6f03a2ea904ca2b3c8ad24e2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 199533f77cb4331908a90346f24610888ef42d6dd2f9866b733752426702e737

Comments