MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486
SHA3-384 hash: c76426f687a4c86f677c2ee361c0b89e31570fafef3bcf5f1438ebe7c519208cdd722d583ece5e073cf34a6204399ec6
SHA1 hash: f10a0fe21115eddf24c3a32f8990b8c7ef753a09
MD5 hash: c539eed408e62abdae345bd297131c87
humanhash: oregon-victor-edward-shade
File name:PO 2100020608-77003731.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:647'899 bytes
First seen:2021-03-31 07:00:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:DVl2Rfr+mB42HaLk64WoKBC4RFTNs3GlXZisgNnojn6Rw3:YfSmBC/EYCIFTHZH4oE4
TLSH 8ED423854C758D33EC7DF585F8BC5ABA40E40BB44CAAEC955479EF62CA369D02CC6AC0
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: srv.turkishacoustic.com.tr
Sending IP: 109.232.221.141
From: Viet Nam Paiho Ltd <vn1420@paiho.net>
Subject: PO 2100020608-77003731
Attachment: PO 2100020608-77003731.rar (contains "PO 2100020608-77003731.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2021-03-31 06:39:35 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b2oh64hslntpkzcn4wco6uoxzt3nax7nhgjsiiefow6j3jgd6sda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 0e9c7f70f25b66f5644de584ef51d7ccf6d05fed399324208575bc9da4c3f486

(this sample)

Formbook

Executable exe 6d1e9e2682482d7d3d3746c5e5678dab00f2e6b9210ec53e3aac20d40af61a3e

  
Dropping
MD5 918ef7fefeab69375ca89574c1cdd536
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6d1e9e2682482d7d3d3746c5e5678dab00f2e6b9210ec53e3aac20d40af61a3e

Comments