MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dc4c33d8aaae2bac9810472d886f9b9c5bfbf6a9619c9a7df971caf516a7253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dc4c33d8aaae2bac9810472d886f9b9c5bfbf6a9619c9a7df971caf516a7253
SHA3-384 hash: 2e045aa0981fe312d800cac9afa6dfabdb498ebf89d43993f98476bb6796eec3d44e5c2b68e64bb9272aedff158bd981
SHA1 hash: 456cc796d98fbca824510cb6e41a11e2d6cb7424
MD5 hash: 9435d98162b001ab63ee4fb02cd977a4
humanhash: dakota-cardinal-foxtrot-triple
File name:07-20-2020_06-59-10-PM.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:1'155'347 bytes
First seen:2020-08-03 13:54:32 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Byio3CYg4opSou+8idaenbwPN50VcaZMf3NOcaFxYL5uPasdHyTyKIZ:oyBdpg+8yaNw5ZMf3NOco65uPoFIZ
TLSH C0353320493E18CCE1C38171D9909A3C9FBBD43C615F89E29A9D8772233C64F965B96F
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: tur2.hipotenus.com
Sending IP: 213.159.30.161
From: office <salhuneidi@gulfcryo.com>
Subject: Ri: Ri: Ri: MERO CO.
Attachment: 07-20-2020_06-59-10-PM.zip (contains "trasferimento bancario.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dc4c33d8aaae2bac9810472d886f9b9c5bfbf6a9619c9a7df971caf516a7253/
Threat name:
Win32.Trojan.Delf
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 13:56:19 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxcmgpmkvlrlvsmbarznrbxzxhc37p3ksym4tj67s4ok6ulkojjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6dc4c33d8aaae2bac9810472d886f9b9c5bfbf6a9619c9a7df971caf516a7253

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6dc4c33d8aaae2bac9810472d886f9b9c5bfbf6a9619c9a7df971caf516a7253

(this sample)

Formbook

Executable exe 45a1bb88d5e48989369b90d346c9d706a24c8b1205c4358b6a3bda278aeee6cf

  
Dropping
MD5 5501968e3d70e460b4475fd8f9e0a9e6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 45a1bb88d5e48989369b90d346c9d706a24c8b1205c4358b6a3bda278aeee6cf

Comments