MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1dfa8054c1f025d8f1022ae8c9be2dbe767d88795f7085f53b872d7acfac3c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d1dfa8054c1f025d8f1022ae8c9be2dbe767d88795f7085f53b872d7acfac3c2
SHA3-384 hash: aa12ba4ed79b820fc0501fc76c6c017173e09c4ff9c14a2ff7d41201ecb9492edcd1312abb29ae4402a471505af96fa1
SHA1 hash: c0799a9e69dcf8f642ff16186d6a8a415dfcee60
MD5 hash: f35aabb98c0b9b38008be1717b76b818
humanhash: pip-eleven-vegan-bluebird
File name:paymentcopy.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:884'518 bytes
First seen:2020-10-12 19:27:40 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:TNUtJUuthBMwaEuJU9d+sUOoQnuivV/HxdsgSW2brEQlMjmSQ:TNUrth2bWv+h6ls3WqqmSQ
TLSH E61533E75A0BAE1F397E293EA6F7078122965B3D37F4C50834D106F3CA455163A86A38
Reporter abuse_ch
Tags:arj FormBook SCB


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.miyoshi.biz
Sending IP: 111.235.136.178
From: Standard Chartered Bank <Account@transfopam.com>
Reply-To: sjrkintluea@gmail.com
Subject: Advice from Standard Chartered Bank
Attachment: paymentcopy.arj (contains "paymentcopy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d1dfa8054c1f025d8f1022ae8c9be2dbe767d88795f7085f53b872d7acfac3c2/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 15:39:09 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2hp2qbkmd4bf3dyqekxizg7c3ptwpwehsx3qqx2txbznplh2ypba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d1dfa8054c1f025d8f1022ae8c9be2dbe767d88795f7085f53b872d7acfac3c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj d1dfa8054c1f025d8f1022ae8c9be2dbe767d88795f7085f53b872d7acfac3c2

(this sample)

Formbook

Executable exe da8c31096f9e2ffc9a1fea4a63d6440cfda55349845300b4f333a02317c73dde

  
Dropping
MD5 44b4e5396a0a6074c98f0f02c8d1abf0
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da8c31096f9e2ffc9a1fea4a63d6440cfda55349845300b4f333a02317c73dde

Comments