MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a5eff98f6be3c126d2f51cbbce31b15a5f18ccb9371e90e19eda861faa0a82d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a5eff98f6be3c126d2f51cbbce31b15a5f18ccb9371e90e19eda861faa0a82d
SHA3-384 hash: 76d26bc765f5822471b269be476f0148ae1c473d327585129d12833553f34cdb6c9de429445e2fc9b18196868eab3c14
SHA1 hash: 3429cbe398042ffe2491bb4722125b58b658afc0
MD5 hash: 922d0f369e1b822c37d379697b6978fc
humanhash: beryllium-michigan-black-twelve
File name:po071.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:972'582 bytes
First seen:2021-01-20 21:05:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:3Wu4OZGIjQYTjRzrsMbo4t99/9WsR9t/UrbdFu4c:mu4OZpjQYTFHp9EsPt1
TLSH 0F2533213F83498BFC07C560969B1C9415F2BF0154F7292EF1C8C96746B86ABE6CDEA1
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "ACCOUNT DEP. <office@zeprials.com>" (likely spoofed)
Received: "from slot0.zeprials.com (slot0.zeprials.com [45.85.90.56]) "
Date: "20 Jan 2021 15:33:46 -0500"
Subject: "BANK PAYMENT COPY"
Attachment: "po071.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a5eff98f6be3c126d2f51cbbce31b15a5f18ccb9371e90e19eda861faa0a82d/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-01-20 21:06:07 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jjpp7ghwxy6be3jpkhf3zyy3cws7ddglsny6sdqz5wugd6vavawq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a5eff98f6be3c126d2f51cbbce31b15a5f18ccb9371e90e19eda861faa0a82d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 4a5eff98f6be3c126d2f51cbbce31b15a5f18ccb9371e90e19eda861faa0a82d

(this sample)

Formbook

Executable exe ed9c5c6d05892ce64f553810dcb3e3f2e8f0f58d46888bbfeeb744e89dd1cf8e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ed9c5c6d05892ce64f553810dcb3e3f2e8f0f58d46888bbfeeb744e89dd1cf8e

Comments