MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6
SHA3-384 hash: 9240f20805442455774b42ddc950ed94bba8475fbef17e23b410d446ee8951eb43b4ca5f3285debccf5513bcaad7e28d
SHA1 hash: fb40cd09de1ec94e824d9d508d2e9d962084c043
MD5 hash: 3a22c6d465914a55a1c8ee922bd8f798
humanhash: wolfram-oscar-mobile-pip
File name:3-23.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:638'972 bytes
First seen:2021-03-23 09:39:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:scTC7uv5alNdqH5AXCvQmImelT7DucWg1OyOI55xz6fB+jKhWZjPi:799u6JWlT/kgQyOI53z6cjldi
TLSH 33D42319E94CC7F0BC8EC33033881B2F85784B7DB59691EB910AD7824DD876CBA5D986
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Sales <postmaster@iglogi-camo.com>" (likely spoofed)
Received: "from slot0.iglogi-camo.com (unknown [194.31.96.45]) "
Date: "23 Mar 2021 01:51:05 -0700"
Subject: "NEW PO"
Attachment: "3-23.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.599.19076.20964.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-03-23 09:40:07 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bkbfqbhssapvbirth5irxd4qkpimht3oapeoshz5i4idciafa7la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 0a825804f2901f50a2333f511b8f9053d0c3cf6e03c8e91f3d471031200507d6

(this sample)

Formbook

Executable exe 91e13d173fb96f025e17161b61686fa06272a048eececeb7d4e95ecdcb3de4b8

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 91e13d173fb96f025e17161b61686fa06272a048eececeb7d4e95ecdcb3de4b8

Comments