MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ac660ea2bb2b6fdded2d58ceaaad003a47c97f58e958ef380f8265a4f57b54f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ac660ea2bb2b6fdded2d58ceaaad003a47c97f58e958ef380f8265a4f57b54f
SHA3-384 hash: 283c0add943e23db7646725c504a887d9ad8dbc61ac46f115fd6d2b584c054486da0ecf289b3c6419695386a8f2615cb
SHA1 hash: d47dedecc449b7b219ffcc23754e3f4d46982870
MD5 hash: ae50a6c76c359415e7c51c966ed489bd
humanhash: berlin-single-tennis-undress
File name:New Doc.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:549'852 bytes
First seen:2020-10-22 11:51:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SUK4qZU3a1GwC2yO0I/Pik+qEKjKdmbpAoUZo6OcZlrtt7:qS3sm2B0Et/KdmVVh6lxF
TLSH 15C42338EC4009FD68A970ABD5712DEA90A8F6ADFF74890F0B75DCB440993421FD25E6
Reporter abuse_ch
Tags:FormBook Outlook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: APC01-PU1-obe.outbound.protection.outlook.com
Sending IP: 40.92.254.82
From: ezrealpan@hotmail.com
Reply-To: geimeg@quipo.it
Subject: FW RE New Contract Invoice
Attachment: New Doc.rar (contains "6z0GZwvVSRNDV96.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ac660ea2bb2b6fdded2d58ceaaad003a47c97f58e958ef380f8265a4f57b54f/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Suspicious
First seen:
2020-10-22 08:15:45 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rldgb2rlwk3p3xws2wgovkwqaoshzf7vr2ky544a7atfut2xwvhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 8ac660ea2bb2b6fdded2d58ceaaad003a47c97f58e958ef380f8265a4f57b54f

(this sample)

Formbook

Executable exe b9fa08af8ceadc9af473f443a5b8c8d0f3e40324df53c81a5da4f97ef946e160

  
Dropping
MD5 811e46ee3cf822d89ec48c267a278d39
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b9fa08af8ceadc9af473f443a5b8c8d0f3e40324df53c81a5da4f97ef946e160

Comments