MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41c7add6269b85f5c830ec3132930bb9544aca869ceddced3e7132d436c25e24. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41c7add6269b85f5c830ec3132930bb9544aca869ceddced3e7132d436c25e24
SHA3-384 hash: 3e7022050eecdc412805315591502cfc96ff7a22fd90d9731ba4e67bbb0d965396f6824ae40eb1df28ab29ee1393e016
SHA1 hash: c83ef33d54b16676b9f16706c8587718e5c63cb9
MD5 hash: 2d88d10e51f4605cc5fe5c60afd8d4ce
humanhash: december-early-batman-coffee
File name:purchase order pdf.r09
Download: download sample
Signature Formbook
Create hunting rule
File size:600'335 bytes
First seen:2021-07-12 05:36:55 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 12288:kLY9M4XsegMQdRN8ixJqgoiRYf9A2Fz8EMYkUk6aL32hvifrG:kLOJsgIOgoIYCGzAYkUkskrG
TLSH T1F3D423D8426D9116B58C2654168872EF9D3322A684EFD8CEB608430DDFBFE1605CDFE9
Reporter cocaman
Tags:FormBook r09


Avatar
cocaman
Malicious email (T1566.001)
From: "Shalithag<shalithag@221.mzxve.club>" (likely spoofed)
Received: "from hp0.221.mzxve.club (hp0.221.mzxve.club [104.248.11.15]) "
Date: "11 Jul 2021 20:36:58 -0700"
Subject: "REQUEST FOR QUOTATION"
Attachment: "purchase order pdf.r09"

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41c7add6269b85f5c830ec3132930bb9544aca869ceddced3e7132d436c25e24/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-07-12 04:00:35 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihd23vrgtoc7lsbq5qytfeylxfkevsugttw5z3j6oezninwclysa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41c7add6269b85f5c830ec3132930bb9544aca869ceddced3e7132d436c25e24

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r09 41c7add6269b85f5c830ec3132930bb9544aca869ceddced3e7132d436c25e24

(this sample)

Formbook

Executable exe e015d30cdddd24a27d1dc9a688027ba65282496188a7db983eef788cfd3a1e8a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e015d30cdddd24a27d1dc9a688027ba65282496188a7db983eef788cfd3a1e8a
  
Dropping
Formbook

Comments