MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a4a4685845029e31b161abc326bbbd9fb83fb30ad068af77ca67d07290a11c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a4a4685845029e31b161abc326bbbd9fb83fb30ad068af77ca67d07290a11c0
SHA3-384 hash: 1f4b1d8dd960b3bc5c9e3bf7ffbeb9d278b92efeac8d35799981069dfde8d7d46eebfb9c74ae2f6415181f7ab6b45a67
SHA1 hash: 6c5ecae6aead4f3a7096e499301bdc98f7f3282c
MD5 hash: 8a4c3f6be803e478403dd261c8ed384d
humanhash: yellow-mockingbird-ink-gee
File name:SOA121520.xz
Download: download sample
Signature Formbook
Create hunting rule
File size:176'258 bytes
First seen:2020-12-15 15:58:51 UTC
Last seen:2020-12-23 03:14:32 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:71bIpDKBrMwBgtmnyEz56n5WlcblehkDA4GLm5LzbyKEoqKxcRR:JIpGMwBgGyc05WOblehU5G2rADH
TLSH 400412172F2A01DB91098E6539DD0EF2213D26CBC6B511F2C13D09351EB61AAAF789DF
Reporter cocaman
Tags:FormBook xz


Avatar
cocaman
Malicious email (T1566.001)
From: ""Martina"<francisong@plasterceil.com>" (likely spoofed)
Received: "from box.kymfers.xyz (box.kymfers.xyz [138.197.174.206]) "
Date: "Tue, 15 Dec 2020 02:15:52 -0800"
Subject: "New Order 30% Payment"
Attachment: "SOA121520.xz"

Intelligence

File Origin
# of uploads :
14
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.cc.29433.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a4a4685845029e31b161abc326bbbd9fb83fb30ad068af77ca67d07290a11c0/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-12-15 15:59:05 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=njfenbmekau6ggywdk6de2533h5yh6zqvudiv534uz6qokikchaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a4a4685845029e31b161abc326bbbd9fb83fb30ad068af77ca67d07290a11c0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6a4a4685845029e31b161abc326bbbd9fb83fb30ad068af77ca67d07290a11c0

(this sample)

Formbook

Executable exe 5b388b9e446fe8ab855e47f8edd5fd92d8487066491d8c32ff43374e46e5548c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b388b9e446fe8ab855e47f8edd5fd92d8487066491d8c32ff43374e46e5548c
  
Dropping
Formbook

Comments