MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed03dedd804548667687d9b507117913d15e766cfb06fc26089c7d30b7408f1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed03dedd804548667687d9b507117913d15e766cfb06fc26089c7d30b7408f1f
SHA3-384 hash: 37ec1294dbe828adb70f347030e75c076f6ace697e32bc422ba5fa2d06d14cc23dc381b45c916bf21b7d9719435b73b2
SHA1 hash: 8b6634d097c65f40825cf62d38dec80b38b9176d
MD5 hash: de17a6149c3b4e4a1e37438ce2ad1646
humanhash: apart-triple-potato-sad
File name:G0170-PF3F-20-02602T.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:979'538 bytes
First seen:2021-02-24 06:55:50 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:zjRRlcHjI48jcPAgYl0xemRs4clEgO0Le2X:zj9MI484P9Yl0xolGgOvK
TLSH FC2533A5E616ECE39EE51B204C0A7DCE5A435C28BB10B39928A1685CC2CDFF5325DF17
Reporter abuse_ch
Tags:cab FormBook geo KOR


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail-smail-vm81.hanmail.net
Sending IP: 211.231.106.156
From: 아인테크 <myoungha2000@hanmail.net>
Subject: 견적요청_아인테크_2021024
Attachment: G0170-PF3F-20-02602T.cab (contains "PO_210224.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.DrodCab-A.30374.18903.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed03dedd804548667687d9b507117913d15e766cfb06fc26089c7d30b7408f1f/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 04:27:05 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ub55xmaivegm5uh3g2qoelzcpiv45tm7mdpyjqitr6tbn2ar4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab ed03dedd804548667687d9b507117913d15e766cfb06fc26089c7d30b7408f1f

(this sample)

Formbook

Executable exe 60ca0a3819cc5a24cb229e79c4fc0ac610e59691fe99dda733cbb5ac06844d41

  
Dropping
MD5 f7c123e214779fbf02702e3485f373f3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 60ca0a3819cc5a24cb229e79c4fc0ac610e59691fe99dda733cbb5ac06844d41

Comments