MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286
SHA3-384 hash: 1091b5a9804f244c83322fc3f4071e0a2b3696fa757a9a16183f6d86cfd9fb6059e0a51400a6c2d9a9e9a1e882e0193e
SHA1 hash: ee194ed86c30a37822e90fd695d38545ff22b69b
MD5 hash: bbcff5c893694167a63789ab94c029f0
humanhash: kitten-hotel-kitten-minnesota
File name:orden de compra.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:342'224 bytes
First seen:2020-08-14 15:05:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:Y9MORLXzStrAAWTDXojY2Q63QxOaFiDvvLi+ZYZvShhSgL+qrYDlK0oMHwNnSfaz:fPrgDMYiQY7LiuYvShhjCqrmKzMHwNnf
TLSH 6E74230FED0F8522E9214C89C1AE6D3CC1EBD89CC85183475AA5AC608B35DE5FB5F936
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server107.neubox.net
Sending IP: 174.136.28.112
From: Juan Saune <proveedores@promedic.com.mx>
Subject: Re: Re: orden de compra
Attachment: orden de compra.zip (contains "orden de compra.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Zmutzy.41.31694.5008.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:07:06 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6czj5egxmx6xifkyq4ymfc5m7rqveuavzfgubwkcf25qmez2kda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 6f8594f486bb2feba0aac43986145d67e30a9280ae4a6a06ca1175d83099d286

(this sample)

FormBook

Executable exe 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3

  
Dropping
MD5 2a30abd4d6db32bfc49a069c56ceb45c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2f9d83d844287396dcaf52b5c15c1dacc92bc4ae2e2777d24c8d09465037ace3

Comments