MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be2b43b19919ec7d8e74f3198bb7ee8d87abe5ec1d2b8ab60086c3dc7b3f3135. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be2b43b19919ec7d8e74f3198bb7ee8d87abe5ec1d2b8ab60086c3dc7b3f3135
SHA3-384 hash: 5fc5f602279dc2b9eeb7503f702887322fb28b7789b5b561cd78c9503a8da493748ab8fe28401092b0ecd8ef42548427
SHA1 hash: e4dbbdf3ab832daeb217e4ee1f219abdda051a8f
MD5 hash: baa88a82a2f4d792577dce19837b8aa8
humanhash: lamp-freddie-dakota-tango
File name:RFQ January.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:661'151 bytes
First seen:2021-01-12 07:25:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:h6Gqhm8bGh6rLiKINxWdbq+useJklLZkLCpTYCvAnE0Qf6xD:h2hXAGzINxWdZiJkhZ8INYnEba
TLSH 70E423A5F1060B28F72B9572DBA7E1F0549099F2043FAF03D00EC954AC9F9D558EAE78
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: Daniel Gomez <biuro@zurawie.info>
Reply-To: mzahar04@protonmail.com
Subject: FW:FW:RFQ
Attachment: RFQ January.zip (contains "RFQ January.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2098.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be2b43b19919ec7d8e74f3198bb7ee8d87abe5ec1d2b8ab60086c3dc7b3f3135/
Threat name:
Win32.Trojan.Strictor
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 07:26:20 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyvuhmmzdhwh3dtu6mmyxn7orwd2xzpmduvyvnqaq3b5y6z7ge2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/be2b43b19919ec7d8e74f3198bb7ee8d87abe5ec1d2b8ab60086c3dc7b3f3135

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip be2b43b19919ec7d8e74f3198bb7ee8d87abe5ec1d2b8ab60086c3dc7b3f3135

(this sample)

Formbook

Executable exe c079b62cce0d0718c3b1f26c3f0f359a7df94acf7e75aea710979fe338ea1f4f

  
Dropping
MD5 5c06a1860366ed65d2baba0844342b5e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c079b62cce0d0718c3b1f26c3f0f359a7df94acf7e75aea710979fe338ea1f4f

Comments