MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ffa6edc1cd151506e2512ac8f3dade5947d26cf25a29e9920f5c41f0a48ca6ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ffa6edc1cd151506e2512ac8f3dade5947d26cf25a29e9920f5c41f0a48ca6ed
SHA3-384 hash: 4b276c9202a9a4fec68bc56722efb8df4d122886a4bc9af8b7f890dc8832743bb46fc92efe07d76d7dd13cf5885453a5
SHA1 hash: 26bd0878fcffd220deb0d80fd95289a7fdff3fa5
MD5 hash: e3565987759d47cff11955e9840964e9
humanhash: sad-zulu-alaska-maine
File name:02-016.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:698'878 bytes
First seen:2021-02-16 07:54:00 UTC
Last seen:2021-02-17 22:03:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:xZHPvyxlvY60FbQlowea5vV0Qluu4mk50+K1vcEwidzDREFnBFDJcU9:Dvy/14bpa590DRkvtwidzDmFBhh9
TLSH 79E4336091A755448267B1753BCC2EA4F1BA5188693B83C2FB4623D90E937F10FAD92F
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "JBL SDN BHD <office@cowbown.com>" (likely spoofed)
Received: "from slot0.cowbown.com (slot0.cowbown.com [203.159.80.100]) "
Date: "16 Feb 2021 01:58:30 -0500"
Subject: "BANK RECEIPT 2-16"
Attachment: "02-016.zip"

Intelligence

File Origin
# of uploads :
3
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ffa6edc1cd151506e2512ac8f3dade5947d26cf25a29e9920f5c41f0a48ca6ed/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 07:54:07 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
8 of 47 (17.02%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=76to3qoncukqnysrflephww6lfd5e3hsliu6teqplra7bjemu3wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ffa6edc1cd151506e2512ac8f3dade5947d26cf25a29e9920f5c41f0a48ca6ed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ffa6edc1cd151506e2512ac8f3dade5947d26cf25a29e9920f5c41f0a48ca6ed

(this sample)

Formbook

Executable exe fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fdf3aa0df3a0d4a6d053c55b970ad22f71f5db88f2da4f94bc18f1926b731f1b

Comments