MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d8b0decca53e916541a799a5354b7d04247f5bb920ec8ea0adf3935adf8071f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d8b0decca53e916541a799a5354b7d04247f5bb920ec8ea0adf3935adf8071f
SHA3-384 hash: 82e13d9f10ab831db9c3cde6e943392508785bf5f2e65097f286376b6039c2052193231850e04570bc7508bad1d2c58e
SHA1 hash: c9f643beca087422e27f508fec514b420b865330
MD5 hash: 644ca59265316226892d5b06c81d1608
humanhash: monkey-sodium-william-mountain
File name:file.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:862'981 bytes
First seen:2020-10-12 06:13:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:g52VHftOjqTWTN/WUePb0DVdef4gi5VrHCW56Rn:/HrTOPdehMVrHCWMn
TLSH 8405235467922FAEF4112CF35901EBF78BE20972EB3FBC8AE7145A5CC1B0516B752902
Reporter abuse_ch
Tags:FormBook geo GRC zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: pl1.azuni.net
Sending IP: 37.26.26.70
From: Spacesonic <info@spacesonic.gr>
Subject: Re: Re: Προτιμολόγιο
Attachment: file.zip (contains "order pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d8b0decca53e916541a799a5354b7d04247f5bb920ec8ea0adf3935adf8071f/
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 04:08:44 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twfq33gkkpurmva2pgnfgvfx2bbep5n3sihmr2qk344tllpya4pq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9d8b0decca53e916541a799a5354b7d04247f5bb920ec8ea0adf3935adf8071f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 9d8b0decca53e916541a799a5354b7d04247f5bb920ec8ea0adf3935adf8071f

(this sample)

Formbook

Executable exe 5f4ef06d276fe789cb466752da51d3c1a29ce62aa090a0b96da012f16bb8f29f

  
Dropping
MD5 d8ce3bb5f304df90bd16cd99f6cfb3a2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f4ef06d276fe789cb466752da51d3c1a29ce62aa090a0b96da012f16bb8f29f

Comments