MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8d523aa28adff326b19c0fbd50339decc6b41b62c1f06aa309dd2b496539be6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8d523aa28adff326b19c0fbd50339decc6b41b62c1f06aa309dd2b496539be6
SHA3-384 hash: 6d607c2c41e65004d3a47d4e125ce3bf9a919bbe2694733a2af101073e6cb1490808b17b59f28e73a14dde923834e8d0
SHA1 hash: 4f865789e1fd828a58e542508c2beca20dafa351
MD5 hash: 5568a5ae9c3989b30ab9c7e4eaed0903
humanhash: social-leopard-south-kitten
File name:ORDER87654.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:561'042 bytes
First seen:2020-11-17 06:10:02 UTC
Last seen:2020-11-17 15:23:09 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:LXHdM/ta02a67M5/kYCVjKHhAtb1LO2HFXzmMtsaR3:m1a0go5/k52Gtb1LrRmmsaR3
TLSH CDC4230B258EB314291BCA858DCC08D1E475D67F50C85E9F5EB5B9AAE7ECD0723102EE
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email (T1566.001)
From: "MARK<info@ribasinternational.com>" (likely spoofed)
Received: "from ribasinternational.com (unknown [62.113.215.229]) "
Date: "17 Nov 2020 16:22:00 +0100"
Subject: "NEW ORDER"
Attachment: "ORDER87654.Z"

Intelligence

File Origin
# of uploads :
8
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8d523aa28adff326b19c0fbd50339decc6b41b62c1f06aa309dd2b496539be6/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-11-17 04:54:31 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dkshkrivx7te2yzyd55kazz33ggwqnwfqpqnkrqtxjljfsttpta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z d8d523aa28adff326b19c0fbd50339decc6b41b62c1f06aa309dd2b496539be6

(this sample)

Formbook

Executable exe 2693356eb785b39160f0dd89c916020ab5ae032faaa931b30c393e93da2740e4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2693356eb785b39160f0dd89c916020ab5ae032faaa931b30c393e93da2740e4
  
Dropping
Formbook

Comments