MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0e8e6ee9d0da1b6636bdabad7f9852c3385511956c6eedc1866232f380dc4a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0e8e6ee9d0da1b6636bdabad7f9852c3385511956c6eedc1866232f380dc4a0
SHA3-384 hash: e83b69ae6fcd61cbff6c6e3bf1344680ddd0c295a8f2e89d026065484a6c902d4a6d01e6ccdb15a6a1ebcf300cafe6e9
SHA1 hash: d41a36c0d42eaab11449e8eec57be24b00a27f2a
MD5 hash: 28bd5acd18cb3e7c45defd36eb50bba0
humanhash: sweet-violet-helium-cat
File name:PO8433L.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:536'461 bytes
First seen:2020-12-02 12:40:52 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:ELcQHsRXZN1iDUWS+B4ScffRS0lM14DtiKg7AupfcMTD8:Icn9tiIWS+BzcfJS0amiFg
TLSH 38B423C4E8EF59978E33F44E6681F486F482B646BC29C0DDDBC291C8CB9997548FD220
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "Murutamad<info@labelingmachine.in>" (likely spoofed)
Received: "from labelingmachine.in (unknown [92.118.190.190]) "
Date: "2 Dec 2020 11:48:39 +0100"
Subject: "NEW PO "
Attachment: "PO8433L.Z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0e8e6ee9d0da1b6636bdabad7f9852c3385511956c6eedc1866232f380dc4a0/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-02 12:41:06 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wduon3u5bwq3my3l3k5np6mffqzykuizk3do5xaymyrs6oanysqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b0e8e6ee9d0da1b6636bdabad7f9852c3385511956c6eedc1866232f380dc4a0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z b0e8e6ee9d0da1b6636bdabad7f9852c3385511956c6eedc1866232f380dc4a0

(this sample)

Formbook

Executable exe 9f1f45b03b4f7909d0bbd7aa98895a0fcd314db228a7a233512c857ad86e7e86

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f1f45b03b4f7909d0bbd7aa98895a0fcd314db228a7a233512c857ad86e7e86

Comments