MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e794498e458da2c7c8f1107333788c5d614929449e932d06220e5c7af554b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e794498e458da2c7c8f1107333788c5d614929449e932d06220e5c7af554b96
SHA3-384 hash: 806ababb86bab53155a851095183adb3f76a7cd5ec5e647257e0b40b58853f01a022aaeac107d91b454641e1513caefc
SHA1 hash: 509109b65e836f470ee3dd3455bedae13e54746b
MD5 hash: d450b63cf7436bd445aa423a5fbf9fab
humanhash: kilo-paris-massachusetts-five
File name:Payment Copy.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:275'637 bytes
First seen:2020-12-31 07:50:30 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:GKnRaUwjv5xKSlws/MNdVntel206zEXA9SUWiIvcDsfZdecx:GKRFC7+sEJEWzEXAsUhX4Zdecx
TLSH DA442367B1D0CEC37935CF274CC271DD8DB90EE7E3C81EA82A206AD124538A6E55DE48
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: ns.soho.co.jp
Sending IP: 211.8.31.18
From: JoJo Hang (SSK-GEN PUR)<JojoHangll@smart-shirts.com.vn>
Reply-To: <JojoHangll@smart-shirts.com.vn>
Subject: Re: GWY-1000-00353- Payment Copy
Attachment: Payment Copy.rar (contains "payment copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e794498e458da2c7c8f1107333788c5d614929449e932d06220e5c7af554b96/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-12-31 06:01:01 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tz4ujgheldncy7epcedtgn4iyxlbjeuujhutfudceds4pl2vjola._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9e794498e458da2c7c8f1107333788c5d614929449e932d06220e5c7af554b96

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 9e794498e458da2c7c8f1107333788c5d614929449e932d06220e5c7af554b96

(this sample)

Formbook

Executable exe 9322c039cec01a5d43492f882c2b5d02aa9357ea4c2e95a039ea1ca1841112da

  
Dropping
MD5 91a91997f8113487f258846b7689bd2f
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9322c039cec01a5d43492f882c2b5d02aa9357ea4c2e95a039ea1ca1841112da

Comments