MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce91fb89c6b20bc04a30fbf7214db04941440303b1062fb387722e164b1d0485. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce91fb89c6b20bc04a30fbf7214db04941440303b1062fb387722e164b1d0485
SHA3-384 hash: 353f9f778573384ed5126f0a93d8d2a939a97a134fbec5560a2fcb384abb8c17a24ff28fe1b482a41835a97e4fbfb41c
SHA1 hash: 0672e3d3affde51dd5fa578ed27f8191c10e8bb8
MD5 hash: 540a650d0593f7d467596e123e6d979b
humanhash: montana-twenty-cup-bravo
File name:RFQ-Haesung-tech-견적요청_해성190918.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'376'256 bytes
First seen:2020-11-19 06:48:53 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:6ED6j4rvrKwang6WCxVA0d6CRAsLPNbZ:6Ed2wa5xB6CaqV1
TLSH D5559F6FA1E0483FC12316399C1B57A85D36BE10F92869463BF81D4C9F39A9178172BF
Reporter abuse_ch
Tags:FormBook geo img KOR


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns.asakurasoft9.jp
Sending IP: 211.1.230.21
From: Haesung Tech Co., Ltd <giga-tech@daum.net>
Reply-To: giga-tech@daum.net
Subject: 조언: Request for quotation _ Haesung Tech
Attachment: RFQ-Haesung-tech-견적요청_해성190918.img (contains "RFQ-Haesung-tech-견적요청_해성190918.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1133.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce91fb89c6b20bc04a30fbf7214db04941440303b1062fb387722e164b1d0485/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 05:04:32 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2i7xcogwif4asrq7p3sctnqjfauiaydwedc7m4hoixbmsy5ascq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img ce91fb89c6b20bc04a30fbf7214db04941440303b1062fb387722e164b1d0485

(this sample)

Formbook

Executable exe 6ea42d461e10aa280c9a3bf273e6edfd0cf92a916f35768546ef7f09484c0829

  
Dropping
MD5 a22175e04cd0fb0bf58a15b2eb6ab978
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ea42d461e10aa280c9a3bf273e6edfd0cf92a916f35768546ef7f09484c0829

Comments