MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8977cde276814f0c7a50433570482252cba261b4d87bafb23556d2c0ef9849f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8977cde276814f0c7a50433570482252cba261b4d87bafb23556d2c0ef9849f1
SHA3-384 hash: f5cef6fb19960dbc3bdf1948bbfbe221a70de6aebbc9478411578daf21c0b546a0e74c94dc01ac0b7fcc45ccb9e56813
SHA1 hash: d4d2e136021eeb67291a6f15d9855d82fc448c8b
MD5 hash: 0877ffaef3193342e3cb50a112df44ad
humanhash: ink-berlin-alanine-sad
File name:NEW PO.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:496'181 bytes
First seen:2020-11-17 06:07:15 UTC
Last seen:2020-11-17 06:09:24 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:olS5KsKSjO4+6HtTMoFRuzYCEGT0iR8+3ncf30RjfpEwUmt6bp:oleKsI4bPFTM0+EWH/oV
TLSH 3AB4237C97F05A73CA4023E90DD86D90385AE71A03ECE95435C72059E8AF5F4F4D19AB
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "LEE<info@tsxyxs.com>" (likely spoofed)
Received: "from tsxyxs.com (unknown [62.113.215.229]) "
Date: "17 Nov 2020 05:27:17 +0100"
Subject: "Purchase Order"
Attachment: "NEW PO.Z"

Intelligence

File Origin
# of uploads :
3
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23007.RarHeur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8977cde276814f0c7a50433570482252cba261b4d87bafb23556d2c0ef9849f1/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 01:27:25 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rf343ytwqfhqy6sqim2xasbcklf2eynu3b527mrvk3jmb34yjhyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 8977cde276814f0c7a50433570482252cba261b4d87bafb23556d2c0ef9849f1

(this sample)

Formbook

Executable exe 6c38cd22154fec33d60c57f97e3a4d09d481f30422c2d0b1a6a65ea65639dd69

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c38cd22154fec33d60c57f97e3a4d09d481f30422c2d0b1a6a65ea65639dd69

Comments