MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be15ce41ac84d7729d5ca62cc7ca12c1022c14d7e6676c8b4000935c744fc20d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be15ce41ac84d7729d5ca62cc7ca12c1022c14d7e6676c8b4000935c744fc20d
SHA3-384 hash: e743c3e3c82254c9c621c4540b04c7ef46ca89c57a1867da0cc24ae4684f4514bcc24cd92d0dd7dd2ce3ef1b772fd7b5
SHA1 hash: 4303730e1c5501996aaf0a81bac0a4790605a760
MD5 hash: e67fe6c22722952836dafe15c76219f1
humanhash: oven-muppet-minnesota-lithium
File name:Order-DOC-1073456778.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:385'914 bytes
First seen:2020-10-16 12:19:52 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:0+wu19NR8BRZoLOGbUdLVHllsL4H35sugFnfb1Ewr53RLZD4W6/fxUR/+NSQS9aJ:bwa7R8BXoLOGbKkK35BgtGwrRRVvOEWV
TLSH 3C84231DBFE4CBD1FDEDA003BA8AFA9A2C2DAC74965C5F76C1244143DE271D84858853
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: uzlinshpl01.uzcloud.uz
Sending IP: 185.74.4.8
From: Amanda Chen <amanda_chen@hotmail.com>
Subject: Re Re: New Order — Top Urgent
Attachment: Order-DOC-1073456778.gz (contains "Order-DOC-1073456778.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be15ce41ac84d7729d5ca62cc7ca12c1022c14d7e6676c8b4000935c744fc20d/
Threat name:
Win32.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 01:34:51 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyk44qnmqtlxfhk4uywmpsqsyebcyfgx4ztwzc2aacjvy5cpyigq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be15ce41ac84d7729d5ca62cc7ca12c1022c14d7e6676c8b4000935c744fc20d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz be15ce41ac84d7729d5ca62cc7ca12c1022c14d7e6676c8b4000935c744fc20d

(this sample)

Formbook

Executable exe ea4d8d060bcd85bdb08cc7bd4f510a8539e84119011abb56e9e0158432e4de54

  
Dropping
MD5 f3ae12a10c48e742ef314bb751fa9148
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea4d8d060bcd85bdb08cc7bd4f510a8539e84119011abb56e9e0158432e4de54

Comments