MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c4679622baa31351a6ed0e262e688d89575349ad3c4f42e9c8b02c0b4cd19f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c4679622baa31351a6ed0e262e688d89575349ad3c4f42e9c8b02c0b4cd19f0
SHA3-384 hash: 2ef191a4fbdd4b930b0a9d1dd783a0473bff715322b6a1f08387b9900fc23ed31d2abe8508192aca6dd01f689e44724b
SHA1 hash: b2d2c1f1393a7b00b140a14cdcb400267fa5f4bf
MD5 hash: 791c7f1af8314ac164ef4362e7a71913
humanhash: white-montana-march-finch
File name:order.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:207'372 bytes
First seen:2020-10-19 06:23:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:G8awxCiCH7TLXWhiKKc2HieHkhMdT4vKu6:G8tnWSh36n0UT4vv6
TLSH 2114121C66C8BF8B56D802F13C564C9F97A808E661BA2C36CBF05FC93780658DC5AD99
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dailysellerbulknews.life
Sending IP: 106.75.28.149
From: Einkauf<sales@dailysellerbulknews.life>
Reply-To: sales2@teweiband.com
Subject: Requsted Order
Attachment: order.zip (contains "order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.145384.17085.9030.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21082.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c4679622baa31351a6ed0e262e688d89575349ad3c4f42e9c8b02c0b4cd19f0/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=frdhsyrlviytkgto2drgfzui3ckxkne22pcpilu4rmbmbngndhya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/2c4679622baa31351a6ed0e262e688d89575349ad3c4f42e9c8b02c0b4cd19f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 2c4679622baa31351a6ed0e262e688d89575349ad3c4f42e9c8b02c0b4cd19f0

(this sample)

Formbook

Executable exe 9068a4f87026bf855c28696f3a82fb1fbb6139782ff7de81321a190cac8699d8

  
Dropping
MD5 d3afa55199519f5e0198f9d3781b1b92
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9068a4f87026bf855c28696f3a82fb1fbb6139782ff7de81321a190cac8699d8

Comments