MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd
SHA3-384 hash: fce57bdb0ae74310f35abd64b2a62eab7173bc39e39b4c7c8ee47ba8c7f57b7de6e3cc53f67123f5834980320cd73663
SHA1 hash: 4c1d3d47d85097230d7c24cb729a0d77a322c5ea
MD5 hash: bd0ec3008560900d10ebd4d15c0a962c
humanhash: purple-kitten-mirror-autumn
File name:4849708PO RMS0001.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:18'795 bytes
First seen:2021-03-22 07:32:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:T1QAAasElDYVp+jxlhuN9p6xkcYMKgggggggmnnnnncnUArVjJUGAPSJc:T1LVP9OUicqgggggggsqvA6S
TLSH 8282BFE4A652CC99D33AF1BCB072DC27F62A408FEDC0C7D80B4AD78782651545AACD64
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gmail.com
Sending IP: 103.156.91.170
From: Taha Sunrays Trading <tstb.umair@gmail.com>
Reply-To: tstb.umai@gmail.com
Subject: REQUEST FOR QUOTATION2021-2773T
Attachment: 4849708PO RMS0001.zip (contains "4849708PO # RMS0001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen12.51207.20311.3522.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 03:27:54 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twhgfrimrknr3aatwku4ainvv7eklzbdq4e7mxqcfjoreim7dlgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 9d8e62c50c8a9b1d8013b2a9c021b5afc8a5e4238709f65e022a5d12219f1acd

(this sample)

Formbook

Executable exe 8c38ea1b07ac6af7083834889e6c999fd84c857a767cf0928be1e7812a594849

  
Dropping
MD5 aecb4e06eb4447cae38b403989190cf1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c38ea1b07ac6af7083834889e6c999fd84c857a767cf0928be1e7812a594849

Comments