MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a06cbc5041aa572d5741da751682ed7cfd4f9dfb8a389e5851fd939796ee82c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a06cbc5041aa572d5741da751682ed7cfd4f9dfb8a389e5851fd939796ee82c
SHA3-384 hash: 802957d87b54b7ab0553dfd5dd8d54f7f6d3ff1fb5d03c4c209b6f07265282de0abde5369b92612b2fd8d36444bc05a7
SHA1 hash: 5d6c757db19a891da02b078312ee9d9616430711
MD5 hash: 8d45a2115740357ec939f221b4c6f1ba
humanhash: hawaii-tennessee-florida-oven
File name:QUOTATION.xlsx.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-15 12:55:18 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hTbHDdiSG0ahtIQs7LHdQqYkNs4tZeIL:hTrDxahtz2LHHNscYo
TLSH 4B45AE727992D93FCA6A07751C2D85C5FAB612D63B908B0D729E4F4CCF01B6BA703246
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: apioptimum.live
Sending IP: 185.144.30.211
From: 美国代理商<Salesagent_1765@apioptimum.live>
Subject: 回复：查询/报价请求
Attachment: QUOTATION.xlsx.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a06cbc5041aa572d5741da751682ed7cfd4f9dfb8a389e5851fd939796ee82c/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 10:09:10 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tidmxriedksxfvludwtvc2bo27h5j6o7xcrytzmfd7mts6lo5awa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9a06cbc5041aa572d5741da751682ed7cfd4f9dfb8a389e5851fd939796ee82c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 9a06cbc5041aa572d5741da751682ed7cfd4f9dfb8a389e5851fd939796ee82c

(this sample)

Formbook

Executable exe 333a258f45e7a8baaab72b1539859a00bca7309a8d641490329184977090b540

  
Dropping
MD5 15cead52848883dce888d9a5832cfdd5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 333a258f45e7a8baaab72b1539859a00bca7309a8d641490329184977090b540

Comments