MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c669b2c2fcc24c024442248840ac310d9ea2d5d58488f991b57b4344439f540f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c669b2c2fcc24c024442248840ac310d9ea2d5d58488f991b57b4344439f540f
SHA3-384 hash: 633124b570541621ab31f16500af759c0799541f1cc1548d8d533ec1953c12730c1dcb1e8a4785c1af57441844a884b3
SHA1 hash: bea6545e57c5d68e9a294da209eb5257154e6a8e
MD5 hash: 25b6b7d71649aed59f8c89f6826ef702
humanhash: pip-lion-hamper-foxtrot
File name:Shippingdoc.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:420'117 bytes
First seen:2020-10-27 16:42:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+I8AUnTeWfO4L+1q8SzmIwLdKNMakCTKSnD+ZKW:98p44iSzsKNdKSEKW
TLSH BF94231B00EB37B251160B36C3E5E1ADC8463D67085C80D6726EB45D7142EBA3E6E9BE
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: web04.sionline.nl
Sending IP: 149.210.191.107
From: TOP UAE SHIPPING <mail@livestreamserver.nl>
Reply-To: ndasupe@outlook.com
Subject: Re: Re: Aw: Aw: Shipping - documents - BL + PL
Attachment: Shippingdoc.zip (contains "Shippingdoc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.15742.8511.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c669b2c2fcc24c024442248840ac310d9ea2d5d58488f991b57b4344439f540f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-27 14:42:32 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzu3fqx4yjgaercceseeblbrbwpkfvovqseptenvpnbuiq47kqhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c669b2c2fcc24c024442248840ac310d9ea2d5d58488f991b57b4344439f540f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c669b2c2fcc24c024442248840ac310d9ea2d5d58488f991b57b4344439f540f

(this sample)

Formbook

Executable exe 9be9720b02fb636479bbf10a2c3e020c7505ceb058821a644d641d8dd6667785

  
Dropping
MD5 8d329796943c23176947550b87320dec
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9be9720b02fb636479bbf10a2c3e020c7505ceb058821a644d641d8dd6667785

Comments