MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a0f1e7eb4d986d39eb93a77e0e6bee121bec8b9a95322a69d9d884dd83d712a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a0f1e7eb4d986d39eb93a77e0e6bee121bec8b9a95322a69d9d884dd83d712a
SHA3-384 hash: 201123175cc08a1297f878c2534b95a32982b1229436ec26e61880787db0337fb32fbe2da80871723ab9e18f37946c17
SHA1 hash: b41e08b8453ee70e79dda9e831127fb7c5d376f4
MD5 hash: 27929c6e4abd1dd425286b4262827800
humanhash: high-diet-mockingbird-lithium
File name:Ixmeut.z
Download: download sample
Signature Formbook
Create hunting rule
File size:4'809 bytes
First seen:2022-08-04 07:09:47 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 96:U+LbLXfiVzaZrAaiwsDhgNKTOaYltKvzWS7iquETejRL:vLbjfiVzaZXiZnWlKzW0ihR
TLSH T162A17DF4B406441469A140CC5E1C732ED06CA955D326938CA37BD8429FD171E16BEA37
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: ""rut.bla"<rut.bla@cyberbaiseuses.com>" (likely spoofed)
Received: "from oapcfkrz.cyberbaiseuses.com (oapcfkrz.cyberbaiseuses.com [85.217.145.44]) "
Date: "03 Aug 2022 18:47:43 -0700"
Subject: "new po"
Attachment: "Ixmeut.z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a0f1e7eb4d986d39eb93a77e0e6bee121bec8b9a95322a69d9d884dd83d712a/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2022-08-04 01:53:12 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bihr47vu3gdnhhvzhj36bzv64eq35sfzvfjsfju5twee3wb5oeva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/0a0f1e7eb4d986d39eb93a77e0e6bee121bec8b9a95322a69d9d884dd83d712a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 0a0f1e7eb4d986d39eb93a77e0e6bee121bec8b9a95322a69d9d884dd83d712a

(this sample)

Formbook

Executable exe 2c6e013e2bc4014fb8a59dd2bcf6bb12b18ee5cd90fce17832a6a6bbcec0517d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2c6e013e2bc4014fb8a59dd2bcf6bb12b18ee5cd90fce17832a6a6bbcec0517d
  
Dropping
Formbook

Comments