MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3409ce10d406201a4281ac38585603be076bc59fca5d1758aac06588e8782953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3409ce10d406201a4281ac38585603be076bc59fca5d1758aac06588e8782953
SHA3-384 hash: 4a4927e1ae40e78dbb4238f4d3fcd35810e1fe1e9d2acc202cb121597e351e970663f4afd5cfd819cb602d572f1d6e53
SHA1 hash: 530133fb32ed9b568702168b639f20c77402e396
MD5 hash: 4359527dfa19287478af7ed3f86e4f25
humanhash: asparagus-two-video-july
File name:Orden de compra.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:593'391 bytes
First seen:2020-10-16 17:49:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:BMTvN09tU6z8w2gZQrvHyJiKw/HfyJrYEfelqJs:BMRWU6lZ4/HfyeeeoJs
TLSH 6FC42329619772F648D36A1029FDFEA8BB14000B75434304D3FAB743A752897D6BB78D
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Pablo González Olguín <info@hmsmakine.com>
Subject: Re: Re: Orden de compra
Attachment: Orden de compra.zip (contains "Orden de compra.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Zmutzy.41.1700.14094.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3409ce10d406201a4281ac38585603be076bc59fca5d1758aac06588e8782953/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 16:00:36 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqe44eguayqbuqubvq4fqvqdxydwxrm7zjorowfkybsyr2dyffjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3409ce10d406201a4281ac38585603be076bc59fca5d1758aac06588e8782953

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3409ce10d406201a4281ac38585603be076bc59fca5d1758aac06588e8782953

(this sample)

Formbook

Executable exe d30e5bd3a0ec9e64eea4363751655f0267d7ffb00a9552862179cd8cf6caa6c0

  
Dropping
MD5 3c6f98e28d6dd69ca0ec3d6cb5d7a4e6
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d30e5bd3a0ec9e64eea4363751655f0267d7ffb00a9552862179cd8cf6caa6c0

Comments