MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b283da67cbcde26d2ea04ace1768f64e10a167e8d34d4d1b737005d584896c94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b283da67cbcde26d2ea04ace1768f64e10a167e8d34d4d1b737005d584896c94
SHA3-384 hash: eb51f92c345579ecbc74544439c5d012494b4f6528efe70fdaf1c5979ca5166f8527ae4c9c7fcc0d4f90de7ed9f23658
SHA1 hash: 123d8a0e7b3351558686547a5a34328f2e1e9804
MD5 hash: 1160de090c9810d18edef48f952962d7
humanhash: angel-sodium-winner-chicken
File name:PURCHASE ORDER.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:253'547 bytes
First seen:2020-10-22 08:14:52 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:KgKVPuCn/+yqT+lgoyeZBUVLJwivvVy+ZBWgfpnD4c:tUP9n/+MlggZBc1yeWgRL
TLSH 5E442304AFBD93102454EAE7D6A736A15386F312E02394067F2F253D9709BF3169BB62
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mg2.eee.tw
Sending IP: 103.17.10.230
From: Hangzhou Zhejiang Co., Ltd. <hm@alphatronmarine.com.cn>
Subject: RFQ # Q20182401 // ORDER_N ° 10014 // New_Suppliers_Ord er / [OCT-DEC]
Attachment: PURCHASE ORDER.rar (contains "PURCHASE ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b283da67cbcde26d2ea04ace1768f64e10a167e8d34d4d1b737005d584896c94/
Threat name:
ByteCode-MSIL.Infostealer.Tepfer
Create hunting rule
Status:
Suspicious
First seen:
2020-10-22 07:21:37 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkb5uz6lzxrg2lvajlhbo2hwjyikcz7i2ngu2g3toac5lbejnska._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar b283da67cbcde26d2ea04ace1768f64e10a167e8d34d4d1b737005d584896c94

(this sample)

Formbook

Executable exe 6eb2ce986b19563b33a0c241aa33feb4e12ad3427ee3dbfb99f530dba3d8dea7

  
Dropping
MD5 43f1eedead36e6d4747c8719d8074bad
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6eb2ce986b19563b33a0c241aa33feb4e12ad3427ee3dbfb99f530dba3d8dea7

Comments