MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7
SHA3-384 hash: 028d5e72c440a7c40cda616578c0bc94e0474347ec2db392ec6b7e82f2a7e63c4eb285e7990cc66a9d0b8e2943b5c23c
SHA1 hash: a58e19449b940bcffa1521b101dea9f1b636e2ba
MD5 hash: 3955015aa2e33447d87572f32f8e079b
humanhash: magnesium-six-bacon-tango
File name:New order.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:584'784 bytes
First seen:2021-03-16 06:31:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qyjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBA:qyFEHwo803r16sZ8hzF6iwzpA
TLSH 39C4231C41FA2DBC62975593E1535FFC44D8B9B93A6F2E62E33A2A034FA1705CD8E042
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Rahul I Atop Solution LLC <coordinator@acs-dxb.com>" (likely spoofed)
Received: "from acs-dxb.com (unknown [217.146.81.124]) "
Date: "16 Mar 2021 05:23:14 +0100"
Subject: "Quotation required-Urgent"
Attachment: "New order.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21106.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 06:32:08 UTC
File Type:
Binary (Archive)
Extracted files:
84
AV detection:
10 of 47 (21.28%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vprz3rc3cfsl6abmhxtb36i6ywmvtbjdxt2prrrff6o3pvu3ao3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip abe39dc45b1164bf002c3de61df91ec599598523bcf4f8c6252f9db7d69b03b7

(this sample)

Formbook

Executable exe 770710adcc9c97316e0f43dcc99ef1561dfe8ec086a1514d4c3d7d0d90b24181

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 770710adcc9c97316e0f43dcc99ef1561dfe8ec086a1514d4c3d7d0d90b24181

Comments