MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef3a29b292cd385c367728192b3cfa5607aa5e06d8c9b43cc36bbfefb24e3a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef3a29b292cd385c367728192b3cfa5607aa5e06d8c9b43cc36bbfefb24e3a36
SHA3-384 hash: 05afb9387a79ea895f7d1662c1943a6cdaf7fa188c3e7bd7cd2e9e5ac6ba65d19ac7594aa0580ac84d0d9aaa78393d95
SHA1 hash: c1a20208cbd19309da60d153d8dbbd574905c1a0
MD5 hash: 9fa31943eca5cdf35a2216fdfd0dd707
humanhash: lake-snake-juliet-arizona
File name:59012.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:233'018 bytes
First seen:2021-03-08 05:55:32 UTC
Last seen:2021-03-10 00:50:34 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:H0zIxO3OoL+3gGIwRXCHfEdGAlVM8jUYVGMsHSeo:FxiOoLXGa/aHjUYVGMwq
TLSH 0D341385F03E5D3BF05072992A0B3D5BA4E571BBB040B9EA145FC132DB2EC3D68E8599
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
5
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_exenum416.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef3a29b292cd385c367728192b3cfa5607aa5e06d8c9b43cc36bbfefb24e3a36/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 01:17:46 UTC
AV detection:
22 of 43 (51.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=545ctmuszu4fyntxfamswph2kyd2uxqg3de3ipgdno767msohi3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/ef3a29b292cd385c367728192b3cfa5607aa5e06d8c9b43cc36bbfefb24e3a36

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ef3a29b292cd385c367728192b3cfa5607aa5e06d8c9b43cc36bbfefb24e3a36

(this sample)

Formbook

Executable exe 38272fb3fbcabee6980aeb4be9ae17147a7979dc415cb3cfbedc48cc298bbefa

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 38272fb3fbcabee6980aeb4be9ae17147a7979dc415cb3cfbedc48cc298bbefa
  
Dropping
MD5 a89b0e84aeb8e838b8e42a221b662b38

Comments