MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac300f254e53873d1ea8734a2279d724451e429c07e54b8702e7a7b85d5b1f1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac300f254e53873d1ea8734a2279d724451e429c07e54b8702e7a7b85d5b1f1c
SHA3-384 hash: d79323c313da8d91853f0c89aa15d3aae07a2666c783ce4d352d8ddd4928d8e68e95dffcbdf3825b169924f3a6e98211
SHA1 hash: 9f23eecb668458362938e10b01962e2772ad4a1a
MD5 hash: 900c11078272353dab81b45c9b13caaa
humanhash: bakerloo-coffee-papa-zulu
File name:PO06112020IMP.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:476'641 bytes
First seen:2020-11-07 10:10:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3GELJQSu6Qt7L/6s3h0qdp6QYIwUaz+Gir:3GJn7Ws3pdp61Qa6Gir
TLSH 80A4239D056AE94EB8D7823223CEFD4A6813EB1627C3727915CF21590B8E38EBC4F405
Reporter abuse_ch
Tags:FormBook lzh


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.85xainji.com
Sending IP: 45.145.185.142
From: Abdelrahman FAYAD <export02@manuelsupermarket.com>
Subject: RFQ YXA0382
Attachment: PO06112020IMP.lzh (contains "QUOTATION REQUEST TW200292 PO#06112020IMP.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac300f254e53873d1ea8734a2279d724451e429c07e54b8702e7a7b85d5b1f1c/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 19:32:41 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vqya6jkokodt2hvionfce6oxercr4qu4a7suxbyc46t3qxk3d4oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar ac300f254e53873d1ea8734a2279d724451e429c07e54b8702e7a7b85d5b1f1c

(this sample)

Formbook

Executable exe 5c1d2289de5b338620bb43ede89d6d7afcf86cc4d2b20db3a3f20e5579e925fe

  
Dropping
MD5 582092a9a8e594881d809a7d544be349
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5c1d2289de5b338620bb43ede89d6d7afcf86cc4d2b20db3a3f20e5579e925fe

Comments