MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce935589ef5fee6bc092ad7922e44d5b225fcf3a3794476faf2ba8f04fbb69fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce935589ef5fee6bc092ad7922e44d5b225fcf3a3794476faf2ba8f04fbb69fe
SHA3-384 hash: 549b191416f121aa95940d0a61a428925de0724ae5996d2e0396ef7151a665bb0bc16c547801a98212885d1ae8b2812e
SHA1 hash: 8a647b18125322438d8feed3655ff5773b125462
MD5 hash: 447fa43b4a98094995d483df477c084a
humanhash: purple-green-alaska-salami
File name:shipping documents.7z
Download: download sample
Signature Formbook
Create hunting rule
File size:870'919 bytes
First seen:2020-10-19 18:15:36 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:wROj7hZtZ8OHLNI1mmXk7f/TfdbZzHZZCP:ntHZ8OB/ycTfdFzHzCP
TLSH E00533CF955AA51F5C9D9D2B9FE8227F0F29036732293938EF906284940B869553F3F0
Reporter abuse_ch
Tags:7z DHL FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail0.grandair.xyz
Sending IP: 143.110.228.46
From: DHL <no-reply@dhl.co>
Subject: Re:Re: D.H.L Parcel Notification
Attachment: shipping documents.7z (contains "shipping documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce935589ef5fee6bc092ad7922e44d5b225fcf3a3794476faf2ba8f04fbb69fe/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 16:59:48 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2jvlcppl7xgxqesvv4sfzcnlmrf7tz2g6keo35pfoupat53nh7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ce935589ef5fee6bc092ad7922e44d5b225fcf3a3794476faf2ba8f04fbb69fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

7z ce935589ef5fee6bc092ad7922e44d5b225fcf3a3794476faf2ba8f04fbb69fe

(this sample)

Formbook

Executable exe 1b10d999126d02956f9d2fec22e0d83b560a5fa8fd873628a6df5650fefe48fd

  
Dropping
MD5 b3515eebac63918e359ba9a8de59c279
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b10d999126d02956f9d2fec22e0d83b560a5fa8fd873628a6df5650fefe48fd

Comments