MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68f55155cc71e3cf0b23a0103d44cc8f62d31c0030c1dfeb04addab8c93864f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68f55155cc71e3cf0b23a0103d44cc8f62d31c0030c1dfeb04addab8c93864f4
SHA3-384 hash: 856811fcfa0a87d885d83d2a776e16528ca3766eff303fc44d566501e31c7ac339af7c6e59fbb2743edaa6855875c75e
SHA1 hash: e850db9f305abe4b0d3e0e6ff705711c35a43d6a
MD5 hash: 7b66439441a3eb09f572d9fa93306a85
humanhash: arizona-ohio-item-oxygen
File name:PO8479349743085.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:240'013 bytes
First seen:2020-10-18 06:40:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:GaOboUPi4L2ld/UxWrjAS9HeRfH2aqyzZWiAzPNwkj:G88DSlKxWfASRIqOZWbPikj
TLSH 963423D0AB0F79176AA9591733108FDEBBDA756B1A06B40C0597FC62AC7DE03087E543
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dailysellerbulknews.life
Sending IP: 106.75.28.149
From: Einkauf<sales@dailysellerbulknews.life>
Reply-To: sales2@teweiband.com
Subject: Requsted Order
Attachment: PO8479349743085.zip (contains "PO8479349743085.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.769701.26337.24312.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68f55155cc71e3cf0b23a0103d44cc8f62d31c0030c1dfeb04addab8c93864f4/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-10-17 17:18:28 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nd2vcvomohr46czduaid2rgmr5rnghaagda572yevxnlrsjymt2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68f55155cc71e3cf0b23a0103d44cc8f62d31c0030c1dfeb04addab8c93864f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 68f55155cc71e3cf0b23a0103d44cc8f62d31c0030c1dfeb04addab8c93864f4

(this sample)

Formbook

Executable exe 92625b5d11e691107b8aa2e733c1be9fe3677b5a86f03e08f239bf6e0d450885

  
Dropping
MD5 ed96c254e53b9d7a33827da32e02d513
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 92625b5d11e691107b8aa2e733c1be9fe3677b5a86f03e08f239bf6e0d450885

Comments