MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a5eede1c01fbf50276e97b645459c1d3ef0fff54843c2583b2ec287373dbfef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a5eede1c01fbf50276e97b645459c1d3ef0fff54843c2583b2ec287373dbfef
SHA3-384 hash: a5461abc24084a43b26a9b31387add352aca240f0637e5a9c67e74e3551ba449ad63f9951c3f06b299c210ef62f802bc
SHA1 hash: d966f791535733edcdb1d4228cc4605b92db7c73
MD5 hash: d09f0b55acadbb54ee548b76d450c1de
humanhash: uranus-utah-golf-artist
File name:Express Shipping and tracking details.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:391'184 bytes
First seen:2020-10-20 08:26:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:iQwLoKRuMgpyT2mDQL8+sNBGK8K7+8qln55RplBxmxxN75PaykquVGkC57YW00eV:izohMgkT2YQL8/t+8+n3RfWv87AYW7AT
TLSH BA8423B37461B8304D31F37B37F30A114FBE48236A251DA39EAE5358A149CA953EDE52
Reporter abuse_ch
Tags:DHL FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail0.naironair.xyz
Sending IP: 138.68.237.164
From: DHL Express Shipping<expresssupport@dhl.com>
Subject: 回复:DHL International Express Shipping and AWB tracking-627****733
Attachment: Express Shipping and tracking details.gz (contains "Express Shipping and tracking details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.14545.15153.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a5eede1c01fbf50276e97b645459c1d3ef0fff54843c2583b2ec287373dbfef/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rjpo3yoad67vaj3os63ekrm4du7pb77vjbb4ewb3f3bionz5x7xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8a5eede1c01fbf50276e97b645459c1d3ef0fff54843c2583b2ec287373dbfef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 8a5eede1c01fbf50276e97b645459c1d3ef0fff54843c2583b2ec287373dbfef

(this sample)

Formbook

Executable exe 3cedd0eac8bec00831ed605f54d9f10fff7c0d7d1d233040ddc78e02d942d928

  
Dropping
MD5 acb8e376ddb700fef135d10685992c15
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3cedd0eac8bec00831ed605f54d9f10fff7c0d7d1d233040ddc78e02d942d928

Comments