MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c9bcbb384a6ab3d113a7e6e7365b4e4c08ed627b33cdee30b491fa3c0540e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c9bcbb384a6ab3d113a7e6e7365b4e4c08ed627b33cdee30b491fa3c0540e42
SHA3-384 hash: 30dc9dd314d5d7147ea3e07debd968343e9ccf1f59fe7d08b6f131aa6a57bfb86c09aa70e5ad7eec4931ca643d75a2af
SHA1 hash: 8e3608896285be2260ff9e44f366a36a977fbb62
MD5 hash: da6dc5505241b4c6414d91a5c70c4d65
humanhash: football-louisiana-august-chicken
File name:DHL Delivery Reciepts.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:436'429 bytes
First seen:2020-08-19 13:38:11 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:BFC7z71/s+N4PlKlpkzISSy9JYoq442SVx71UXoeWgF:BFC7z71/lflCzIly9JqZ28aXoRgF
TLSH D4942366ACF0F3C5C28CB5DD36D99406206133BD0CFFDB480B98BABA59155A5BC2FA11
Reporter abuse_ch
Tags:arj DHL FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: xzn0.722.metalvxini.ga
Sending IP: 178.62.200.135
From: DHL QUERY <dhaquery@dhl.com>
Subject: DHL: Urgent:Delivery Receipt Wrong delivery Address Report
Attachment: DHL Delivery Reciepts.arj (contains "DHL Delivery Reciepts.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c9bcbb384a6ab3d113a7e6e7365b4e4c08ed627b33cdee30b491fa3c0540e42/
Threat name:
Win32.Infostealer.CoinStealer
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 10:09:12 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dsn4xm4eu2vt2ej2pzxhgznu4tai5vrhwm6n5yyljep2hqcubzba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1c9bcbb384a6ab3d113a7e6e7365b4e4c08ed627b33cdee30b491fa3c0540e42

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 1c9bcbb384a6ab3d113a7e6e7365b4e4c08ed627b33cdee30b491fa3c0540e42

(this sample)

Formbook

Executable exe 13e11d298269b106ef9529e7cd3c659bc59b4acb040f521a682f55e49c4ae7a9

  
Dropping
MD5 c0af4ed984309abb78bd78f8c44d5727
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13e11d298269b106ef9529e7cd3c659bc59b4acb040f521a682f55e49c4ae7a9

Comments