MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6588675ec13502ed3420790704e5dd63c8c813a8ed52536efcf2c12de7d042cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6588675ec13502ed3420790704e5dd63c8c813a8ed52536efcf2c12de7d042cc
SHA3-384 hash: f6f80cdc6221d80ced014327d508d5c0253460e027aef99ed837871d85bbf30b5049dfeb04023de03695f162f053cef9
SHA1 hash: 9f8ce4267f56b96772555a547b8e19957a522a91
MD5 hash: 29b905c5fac3b41ce02a07ab12b47017
humanhash: south-double-echo-hawaii
File name:PO8479349743085.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:216'169 bytes
First seen:2020-10-19 06:34:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:7+BMVT6KPyYLnaxppjy/8HzsWi5pN35J0eQG+dNNScOTbk:OMVBVLnSpje8Hz1i5pd0ecdGcOE
TLSH 8724239CB375BC3EE745EA47692C6751F43AB666813BA251143DDA032BD8CECCA04237
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.199
From: 杨玲 <sales2@teweiband.com>
Subject: urgent quote
Attachment: PO8479349743085.zip (contains "PO8479349743085.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.dc.24128.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6588675ec13502ed3420790704e5dd63c8c813a8ed52536efcf2c12de7d042cc/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mwegoxwbgubo2nbapedqjzo5mpemqe5i5vjfg3x46las3z6qilga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Noon
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/6588675ec13502ed3420790704e5dd63c8c813a8ed52536efcf2c12de7d042cc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6588675ec13502ed3420790704e5dd63c8c813a8ed52536efcf2c12de7d042cc

(this sample)

Formbook

Executable exe fd09ea46df289ee19611d096f5281c1e15ee2bc2c54388dd35adfa17837eb038

  
Dropping
MD5 2c47dcf033b6579ab4eca09eb4be79a0
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fd09ea46df289ee19611d096f5281c1e15ee2bc2c54388dd35adfa17837eb038

Comments