MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c65ffe02b3ad54914b64982d0cc47103c5ab42336bef6856e9b083a512666fca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c65ffe02b3ad54914b64982d0cc47103c5ab42336bef6856e9b083a512666fca
SHA3-384 hash: 7aeb3c55e77d0e7b033414a6672289ea5d0cdc927d0a86825b742ded2d089efa3bbeb0c7b170235f368012e24b2a3f73
SHA1 hash: 4ffdb18f4995d78061988cb246814a7deb800dbd
MD5 hash: b97cdb8bc36bc4766c34f38f2a6bea98
humanhash: sad-cardinal-orange-pennsylvania
File name:RFQ28.10.2020.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:574'824 bytes
First seen:2020-10-28 07:59:44 UTC
Last seen:2020-10-28 09:48:03 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:81EinnlUPJOMskFgnoU5b0yOyPZsSMtku8PvOr6gCibu2:5alSOMKoUvOkpXPaCiu2
TLSH A0C42343A97B20FD8AC3D07719A9425008D98EEB64C4EEF920495DBD1BAFE07C5D5D0B
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Robert-SCM <ads.annna@yandex.com>
Subject: RFQ
Attachment: RFQ28.10.2020.zip (contains "Order requirements.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.44239831.26763.9247.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.44239834.20979.18455.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c65ffe02b3ad54914b64982d0cc47103c5ab42336bef6856e9b083a512666fca/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 02:41:44 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzp74avtvvkjcs3etawqzrdrapc2wqrtnpxwqvxjwcb2ketgn7fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c65ffe02b3ad54914b64982d0cc47103c5ab42336bef6856e9b083a512666fca

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c65ffe02b3ad54914b64982d0cc47103c5ab42336bef6856e9b083a512666fca

(this sample)

Formbook

Executable exe 0920951a2739c975661a70c9a7532d65a0abe3d8cee5d476af53b2b60cb63bd3

  
Dropping
MD5 2d3cdc1f4189bdf4ba2d1e98a77b041a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0920951a2739c975661a70c9a7532d65a0abe3d8cee5d476af53b2b60cb63bd3
  
Dropping
SHA256 899f6e35cd5d54ccc7c6dadd6fa35a719a1ec6a1a19a6df0e49b252491d03fd6
  
Dropping
MD5 293092c7d20808dcd3ab643ec169ae4e

Comments