MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a7db5d2f431f5577e953222a5db5a21de5edfb70fc4fc9d9a8055e1fd41b6e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a7db5d2f431f5577e953222a5db5a21de5edfb70fc4fc9d9a8055e1fd41b6e5
SHA3-384 hash: 27d6428492ee63275238c71e4edea0973b8c50376c43e2bf0a50b079e15372e58f7ec35fc871fe829f361bef258798c3
SHA1 hash: 2ea6b22f9f97febefab166cc431dc1a61a820cda
MD5 hash: d035a9608d3149336d9528c2c082d9b1
humanhash: lemon-zebra-fanta-failed
File name:Shipping Documents PLBL Draft.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:271'860 bytes
First seen:2021-01-12 07:21:13 UTC
Last seen:2021-01-12 08:08:52 UTC
File type: r00
MIME type:application/x-rar
ssdeep 6144:99C8/cW9MXCMcbcSRO7N1Eor+35uTaUCI5S+QZ:HC859g6bDYJr+YTaY5SXZ
TLSH 70442303BBC34CAA96C83195684B8039FDBACE3EA995C58715A575FF283E1C70513B78
Reporter abuse_ch
Tags:DHL FormBook r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cds0.520.xvwox.ml
Sending IP: 159.89.143.32
From: DHL Express <support@dhl.com>
Subject: Consignment Notification: You Have A Package With Us
Attachment: Shipping Documents PLBL Draft.r00 (contains "Shipping Documents PL&BL Draft.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a7db5d2f431f5577e953222a5db5a21de5edfb70fc4fc9d9a8055e1fd41b6e5/
Threat name:
Win32.Trojan.Ulise
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 03:20:28 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bj63luxugh2vo7uvgirklw22ehpf5x5xb7cpzhm2qbk6d7kbw3sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0a7db5d2f431f5577e953222a5db5a21de5edfb70fc4fc9d9a8055e1fd41b6e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 0a7db5d2f431f5577e953222a5db5a21de5edfb70fc4fc9d9a8055e1fd41b6e5

(this sample)

Formbook

Executable exe 6ac9238d32f2a7b7315cdb2755e090aa53431a71d613e188209b02105e3b8af9

  
Dropping
MD5 1ba16598fa883ad4f4c2238c773268f5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ac9238d32f2a7b7315cdb2755e090aa53431a71d613e188209b02105e3b8af9

Comments