MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 640e51c25ad0bb091ba9acf6a48e821164ead86439a25be591e749979bb8710b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 640e51c25ad0bb091ba9acf6a48e821164ead86439a25be591e749979bb8710b
SHA3-384 hash: f3ad892b4848c2e0ed5639c9494da92f6d7271a9dc29fdbb62b4af080ac829492009a7d8e84fb2ca1d6c7f208e907b4f
SHA1 hash: 549144c6116eb50002df676df9a80ef6e64586b0
MD5 hash: f50bd3c1e5120947fe1b12df62b5f491
humanhash: september-fruit-blossom-washington
File name:Details.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:497'070 bytes
First seen:2020-07-18 08:51:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:RJSM/ZXZRs0ngQObuAuGHVe/uuANYVdh2+7LvthI9/c:RJSM1jsiVOmHgYVxjfI9/c
TLSH 1AB423D4BFF87258CAD38A07A5534E445EB8E721C204C52F1D01EB72F63A5A99EBBC05
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: w2k12mx04.dc1.ca.ihglobaldns.com
Sending IP: 192.175.105.170
From: Cihan Insurance <s.entezari@chitotech.com>
Reply-To: s.entezari@chitotech.com
Subject: Re:PO/DOC 10940389RN
Attachment: Details.zip (contains "Zbicswp.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/640e51c25ad0bb091ba9acf6a48e821164ead86439a25be591e749979bb8710b/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-07-18 08:52:06 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mqhfdqs22c5qsg5jvt3kjduccfsovwdehgrfxzmr45ezpg5yoefq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/640e51c25ad0bb091ba9acf6a48e821164ead86439a25be591e749979bb8710b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 640e51c25ad0bb091ba9acf6a48e821164ead86439a25be591e749979bb8710b

(this sample)

Formbook

Executable exe f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2

  
Dropping
MD5 622dca0ee8175c9a20456d8892d35a80
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2

Comments