MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0800b28dde9fd23fddb138c7499a1318e19d77d411fe8d39bdc4c49b8601077c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0800b28dde9fd23fddb138c7499a1318e19d77d411fe8d39bdc4c49b8601077c
SHA3-384 hash: 983002953f78a71b93f39765dd7cc8ebc0857a1564f4bdf575c93c9212e376ad3f2e1fdcef9cc8f316d459bafc4d6567
SHA1 hash: f6d85a73cefbee6fb6b25aedce72b5110d179cd1
MD5 hash: 2e473f028f99765a43874b5237246462
humanhash: nine-football-mars-ten
File name:lednew.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:364'583 bytes
First seen:2020-10-13 10:36:54 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 6144:/oWE8y25B+ZzL9elqsXZG+0HTao8o1WPBRScXdcJzkj45fifXHz3:Ax8ysQzLElqs8+mh2BRjtcJz1OHL
TLSH 917423F6432AC6F12351C4ADC1CC893A439B4A605AF759337D9BF219CBC69E1EEE2110
Reporter abuse_ch
Tags:FormBook Outlook r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: EUR04-DB3-obe.outbound.protection.outlook.com
Sending IP: 40.92.74.107
From: alann_marks.sourcing01@outlook.com
Subject: Request for led Product
Attachment: lednew.r00 (contains "lednew.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0800b28dde9fd23fddb138c7499a1318e19d77d411fe8d39bdc4c49b8601077c/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 08:31:19 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=baalfdo6t7jd7xnrhddutgqtddqz256uch7i2on5ytcjxbqba56a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0800b28dde9fd23fddb138c7499a1318e19d77d411fe8d39bdc4c49b8601077c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 0800b28dde9fd23fddb138c7499a1318e19d77d411fe8d39bdc4c49b8601077c

(this sample)

Formbook

Executable exe 1d9958a0a083b0f134bf5c777e6cee112d30f6059e3f7d301cf78e3777b7a637

  
Dropping
MD5 c6ea4d854b4d2f5181925b2512585dca
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d9958a0a083b0f134bf5c777e6cee112d30f6059e3f7d301cf78e3777b7a637

Comments