MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41f21a5b19c8ecd057773853b6d4ceff668acde4abe513225a27a46fd1e0d939. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41f21a5b19c8ecd057773853b6d4ceff668acde4abe513225a27a46fd1e0d939
SHA3-384 hash: 532eb3e8fd8974859d79119b75ad8d91b157f9f6fd41b905ec0c91fb3e45f130bd615fca619ce2b1c6018a77a872fcec
SHA1 hash: 0dceba47a4498f80702f340428ebb0a07880c31d
MD5 hash: 3d10d232679231685fd9ff6fae798ac3
humanhash: carbon-blue-robert-island
File name:PO646756575646.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:248'896 bytes
First seen:2020-10-26 14:48:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:pVkIHdknRhmMKHh/LK1zR8m2gHOTAJ4dvxXpqCjp:sIynmMSYRU1AJ4hxXkk
TLSH F03423B3D7C2218D4B9C29A49D7AC1B7F86AB81B17CB71579B18EC4ED0888C3571C638
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: lucky1.263xmail.com
Sending IP: 211.157.147.130
From: 杨玲 <sales2@teweiband.com>
Subject: PO#646756575646
Attachment: PO646756575646.zip (contains "PO#646756575646.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41f21a5b19c8ecd057773853b6d4ceff668acde4abe513225a27a46fd1e0d939/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 08:38:51 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ihzbuwyzzdwnav3xhbj3nvgo75tivtpevpsrgis2e6sg7upa3e4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 41f21a5b19c8ecd057773853b6d4ceff668acde4abe513225a27a46fd1e0d939

(this sample)

Formbook

Executable exe ae28aba3d630a1246c0d3675e70237f1289956548f4e24e03a5a19c83579c769

  
Dropping
MD5 e6d9233e545963386d748989bb29f574
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae28aba3d630a1246c0d3675e70237f1289956548f4e24e03a5a19c83579c769

Comments