MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07271d551f02128d6849685d605c90be0e5ecfecba72246366cccef83a3df627. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07271d551f02128d6849685d605c90be0e5ecfecba72246366cccef83a3df627
SHA3-384 hash: e1b5f2898fae93422f6a508cd1225e6608136d667a193dd35aac81220fa3b354ba6591fa2f86a57764b1ab6d0b8fd213
SHA1 hash: 0577a89ef7370e75b4e8e0219ce21676f180fb1a
MD5 hash: 691f68567112073228b7dd8e866bbce1
humanhash: vegan-apart-yankee-florida
File name:Shipping Documents.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:354'593 bytes
First seen:2020-08-14 14:57:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:gaQtvn4Poa+ELF2YsTtyP+YdTwiy3fT+wDnVzjCbDxmOyAQL3LYBV:ryvnA+ELF2py3dqawTVzG/Q3AwC
TLSH 557423603EE578A912024A910F44E771F6502E6D279D02173F6A19A78DF291733F2F9E
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.b-io.co
Sending IP: 156.96.59.30
From: ''Support''<supportvietnam@dhl.com>
Subject: Delivery Notification
Attachment: Shipping Documents.zip (contains "Shipping Documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21092.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07271d551f02128d6849685d605c90be0e5ecfecba72246366cccef83a3df627/
Threat name:
ByteCode-MSIL.Trojan.LokiSteal
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 14:58:13 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a4tr2vi7aiji22cjnbowaxeqxyhf5t7mxjzciy3gzthpqor56ytq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07271d551f02128d6849685d605c90be0e5ecfecba72246366cccef83a3df627

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 07271d551f02128d6849685d605c90be0e5ecfecba72246366cccef83a3df627

(this sample)

Formbook

Executable exe f9fa0a06495f261c09ee9f5cd1f3e32ed8d05e6cc65ed223adb4bf6c02cc90dd

  
Dropping
MD5 b8c2e992eae9d82c4a03159e41783015
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9fa0a06495f261c09ee9f5cd1f3e32ed8d05e6cc65ed223adb4bf6c02cc90dd

Comments