MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de9d2d9412783fcc8a3b6f99e4de5e03571dd2d8daaf41a8bcf380369ca7784b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de9d2d9412783fcc8a3b6f99e4de5e03571dd2d8daaf41a8bcf380369ca7784b
SHA3-384 hash: c3baa0bc9ff2e065c37b625d8df2bb910b653bacd55a85e09c38bdadce7ee5a3edb00e8691f6c2d871229e1ee810e89f
SHA1 hash: 6be8195e09cffbe3720dc6346c01f40ba769aeb1
MD5 hash: 058a2e17928c4143c721d0e0babc8e56
humanhash: india-cardinal-tennis-washington
File name:Purchase order 104765 ....
Download: download sample
Signature Formbook
Create hunting rule
File size:870'795 bytes
First seen:2020-08-18 06:27:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:eiC1pmNIHJ4HX51ejxAtV9T1tYUCyz7t6Z:qmSHJea9KwmA
TLSH 6305336ECB21379A132712CB72D96906688E059D6F00B7EB8F039465DD780B4E358FDA
Reporter abuse_ch
Tags:FormBook Hostwinds


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hwsrv-760083.hostwindsdns.com
Sending IP: 104.168.214.40
From: Purchasing <info@bimo-idea.co>
Subject: Purchase order 104765
Attachment: Purchase order 104765 .... (contains "Purchase order 104765.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de9d2d9412783fcc8a3b6f99e4de5e03571dd2d8daaf41a8bcf380369ca7784b/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 06:29:09 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32os3faspa74zcr3n6m6jxs6anlr3uwy3kxudkf46oadnhfhpbfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar de9d2d9412783fcc8a3b6f99e4de5e03571dd2d8daaf41a8bcf380369ca7784b

(this sample)

Formbook

Executable exe 33bba4987ed156603ef0d3d38b149b2f3d0bed4d52adf5615a6d19013cb7a94e

  
Dropping
MD5 1a27bd69479dc1aae06fbf6b7e4ef314
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 33bba4987ed156603ef0d3d38b149b2f3d0bed4d52adf5615a6d19013cb7a94e

Comments