MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2b0694559940e875b084f359c83313e88cb7ae4d5fd990e89f784206daefbf6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2b0694559940e875b084f359c83313e88cb7ae4d5fd990e89f784206daefbf6
SHA3-384 hash: 995ed34497f0e1e4b04d0f106f88655d0960e8547f0d4b5421a8200b80dfe25b935a12b1938b77d011c6bb55b070f578
SHA1 hash: a5481754246daf7b9bac775eebb4a9b71a56645e
MD5 hash: 3b638208645201f84b87a8f3753b348c
humanhash: lion-echo-illinois-berlin
File name:ALPHA_PO_16201844580.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:449'195 bytes
First seen:2020-11-09 15:58:39 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:RT9dTtdTn7YMi0s8uNJ8sozPzEoxz7zZLF+9CBM2DGRxRXJxvB9Qj1NqXTZphJjZ:RpdTtp8zZ8uFoHh7VYC23XPJ961upJEi
TLSH A7A42375F9A3876D28A76C805E2913C243A2C2FBA69E877BCF2907547DC13F6C4164E1
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: thaimartin.co
Sending IP: 111.90.145.169
From: Victor Alexander <victor@alexanderandasso.com>
Subject: ALPHA_PO-16201844580 ( ALPHA INTERNATIONAL TRADING Co.,Ltd )
Attachment: ALPHA_PO_16201844580.rar (contains "ALPHA_PO_16201844580.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2b0694559940e875b084f359c83313e88cb7ae4d5fd990e89f784206daefbf6/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ukygsrkzsqhiowyij42zzazrh2emw6xe2x6zsduj66cca3no7p3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a2b0694559940e875b084f359c83313e88cb7ae4d5fd990e89f784206daefbf6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a2b0694559940e875b084f359c83313e88cb7ae4d5fd990e89f784206daefbf6

(this sample)

Formbook

Executable exe 91611c980854c78b5da49e48553e20e646e4ab8d74f03fc4b2ced8058e818e66

  
Dropping
MD5 adeea1d1379f7be003a9d616f5e5900e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91611c980854c78b5da49e48553e20e646e4ab8d74f03fc4b2ced8058e818e66

Comments