MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a471efd2f041c8437d0a826a2668fc7a1450bb58bcc97ecbb9e0a955d7f9de5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a471efd2f041c8437d0a826a2668fc7a1450bb58bcc97ecbb9e0a955d7f9de5a
SHA3-384 hash: eaef29fe33a360276a1d377a18bd1fb039cdc136528084d29acc1bc318f610078a341eebc7d44d1b89c8036ceb4ad0d1
SHA1 hash: b872b61691fbaf45bb2fc1e95c694354ff396c01
MD5 hash: d4eb58ea7d4c6e0929bd9fe7018afbb4
humanhash: spring-grey-island-avocado
File name:15012021546.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:518'788 bytes
First seen:2021-01-15 07:13:54 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:vy6yfAQ/F7+EVt9R7wbT52Ts+5yyu1brbs3WhtDcnr:ryfAe4EVKP524+5+qI0r
TLSH 12B423D1DB090E0AF1A623B766E7CB40547C6C7A834AFF65A582EF05D6D38022D817A7
Reporter abuse_ch
Tags:cab FormBook geo KOR


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail-smail-vm87.hanmail.net
Sending IP: 211.231.106.162
From: 정상훈 <jsh-9400@daum.net>
Subject: 견적 요청 /RFQ-15012021-Order-2021 Quote
Attachment: 15012021546.cab (contains "15012021546.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Fareit.cc.15001.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a471efd2f041c8437d0a826a2668fc7a1450bb58bcc97ecbb9e0a955d7f9de5a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-15 03:09:18 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ury67uxqiheeg7ikqjvcm2h4pikfbo2yxtex5s5z4cuvlv7z3zna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/a471efd2f041c8437d0a826a2668fc7a1450bb58bcc97ecbb9e0a955d7f9de5a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab a471efd2f041c8437d0a826a2668fc7a1450bb58bcc97ecbb9e0a955d7f9de5a

(this sample)

Formbook

Executable exe cf5a2454c16d739c04939e84f71d62772620f7d0f90df49266e8493393da7167

  
Dropping
MD5 85c2653a529637c000fa5ac67665dcb3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf5a2454c16d739c04939e84f71d62772620f7d0f90df49266e8493393da7167

Comments