MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ed3d6a4aa69815313d58156b950a253dfc4988ade8bf3361195a36fb8219b61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ed3d6a4aa69815313d58156b950a253dfc4988ade8bf3361195a36fb8219b61
SHA3-384 hash: e088b67095c9ec1a10e758b2fcf957cc2f6b8c63a4bd446d80a409b43469eb609be3ab0d5965dd5148409ddff8feaa87
SHA1 hash: 7dcabc0ab0badd0fe20ea0d64b6e8cfee9efa9c5
MD5 hash: a96ca488a224732c8ee704b0f0510e4f
humanhash: thirteen-arkansas-network-comet
File name:Request a quote Mitsubishi Japan XN501.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:697'439 bytes
First seen:2021-01-14 06:53:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Wji/giazFLVmuKWAfH/T9lu/PkxNKelHXCsMpoSW4dTV+jQI1AK1pcuiJrZVq:h4DhhmuKlfh0+NKelSpoSW4WEgH1pnKK
TLSH E1E423F0BA325C4210E5DFFA8566A8881D1187FE6C587562BF2E55EC07E7C0CD83D6A2
Reporter abuse_ch
Tags:FormBook geo KOR zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail-smail-vm58.hanmail.net
Sending IP: 203.133.181.17
From: kimlee <japan20121@daum.net>
Subject: 견적 요청 Mitsubishi Japan XN501
Attachment: Request a quote Mitsubishi Japan XN501.zip (contains "Request a quote Mitsubishi Japan XN501.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ed3d6a4aa69815313d58156b950a253dfc4988ade8bf3361195a36fb8219b61/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-14 06:54:06 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3j5njfkngavge6vqfllsufckpp4jgek32f7gnqrswrw7obbtnqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6ed3d6a4aa69815313d58156b950a253dfc4988ade8bf3361195a36fb8219b61

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6ed3d6a4aa69815313d58156b950a253dfc4988ade8bf3361195a36fb8219b61

(this sample)

Formbook

Executable exe b6dc1192212d0ae4c5509491a96602f9c3da82694097372e9bf5ae03ca86adba

  
Dropping
MD5 d5079ba6252ba0df47a279c217f79abe
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b6dc1192212d0ae4c5509491a96602f9c3da82694097372e9bf5ae03ca86adba

Comments