MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c51670f39982186befd61a3fd56de16fbeacc7c549b3bf6b9a0866009f746620. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c51670f39982186befd61a3fd56de16fbeacc7c549b3bf6b9a0866009f746620
SHA3-384 hash: 187ce78b6cfb51ec1298b8bfe4ee6d83a7eab63df20fb43ae8c1e4b430d74056bab2dfb8d010cd0f23162070bfce1ae4
SHA1 hash: 620be1e430b6805eb748cca26141fb91901b96b3
MD5 hash: 1030c6950ce90cce1079896193c5d12d
humanhash: east-colorado-emma-happy
File name:Quotation.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:370'813 bytes
First seen:2020-10-12 06:08:18 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:gPMsKPkzswOREY+Xcm27TiIJ5oTRbq6D05Sl047EaE7WZ2yMuchF7BIt3oFQA:ZsK8zswOH+XYNJyTN6Se47EuOuchF7f
TLSH FE74231E6707A4EF9309F402BD4E90F5955E5A40214F72EFA73EB42DB4867712B32AE0
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: qq.com
Sending IP: 183.3.226.186
From: Peipei <peiyang@greentopiachina.cn>
Subject: RE: NEW ORDER CONFIRMATION
Attachment: Quotation.zip (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c51670f39982186befd61a3fd56de16fbeacc7c549b3bf6b9a0866009f746620/
Threat name:
Win32.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 05:19:39 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c51670f39982186befd61a3fd56de16fbeacc7c549b3bf6b9a0866009f746620

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c51670f39982186befd61a3fd56de16fbeacc7c549b3bf6b9a0866009f746620

(this sample)

Formbook

Executable exe d3096fc849c6c61f96bd31d7cdd062720e18e50a8ad5cabc23c7156c0ecef316

  
Dropping
MD5 850f4857906b0504c750abc76270bb7f
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d3096fc849c6c61f96bd31d7cdd062720e18e50a8ad5cabc23c7156c0ecef316

Comments