MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25
SHA3-384 hash: f1f6b2a66175153c61c4ced1344f26ec2fb18be2558fc9a0c6d66fe4e5f0c48faf0813dbcde5810817005fa7e10f11c7
SHA1 hash: 5abd3124d9c63bec84f091ae0d2461251bf1f2ab
MD5 hash: 2c74c8be2a4b36a91488b2ba3823f4ba
humanhash: lactose-mountain-thirteen-quebec
File name:OF556701.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:215'161 bytes
First seen:2021-04-08 15:49:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:wuuq0mhRf+8aXqr+NiaIGchi0wuGMBeFzC2y:8qNf+4YIG2quGbeF
TLSH 652423D01121A43B6E5CA380C327857D598B7880AF7BD9F3472786BF9D165C9EBCE281
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mixer.mynet.it
Sending IP: 80.68.177.43
From: Silvio Mazzocchetti <SMazzocchetti@ccsol.it>
Reply-To: Silvio Mazzocchetti <orlandomexico@ortiz.biz>
Subject: Richiesta offerta / PRICE REQUEST
Attachment: OF556701.rar (contains "OF556701.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2o47x7iujoyaxcl3rxjb5gltyznwpxoyvuohkmz3cxonjvftisq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.67
Link:
https://yomi.yoroi.company/submissions/6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25

(this sample)

Formbook

Executable exe 8503c4ec4121647a225068e8defe8ff2e4cfc61a94dcd3c261ec5acf38dfa73b

  
Dropping
MD5 fa96de1d9417c3f2967c57d26799453e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8503c4ec4121647a225068e8defe8ff2e4cfc61a94dcd3c261ec5acf38dfa73b

Comments