MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3bcedbf544bfd621aabc477374781a27715c69b6a399f9392b4b54e76f3a47d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3bcedbf544bfd621aabc477374781a27715c69b6a399f9392b4b54e76f3a47d
SHA3-384 hash: ce48e0ba67e4feace06127b187b1a6b193d248462e6a7c70d0e1aec1be4d8de6656023f3112c9c4708657b1189c3949e
SHA1 hash: a8b148b9d2a66463122ba024a5ec914cfc3ea683
MD5 hash: fef3e9d2f310c4434e5e608c0ff11f28
humanhash: mississippi-fruit-hydrogen-maine
File name:Purchase Order-10764.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:588'758 bytes
First seen:2021-05-10 10:52:21 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:WvzZ/YgkzZSzwksYOcsdXAsjwwdFO7qMdplM659IZCI0z:W71x2ZwwkKrjnaqM3d70CI0z
TLSH BFC423C9607D6D072860A063109DD5B2FCDE4AAF47364EE6E1BBD12EA71C4C6B71C263
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Eby | Valtronics DWC <sales1@ssoeonline.com>" (likely spoofed)
Received: "from ssoeonline.com (unknown [45.137.22.71]) "
Date: "10 May 2021 00:14:09 -0700"
Subject: "RE: Purchase Order-070/POR/044127"
Attachment: "Purchase Order-10764.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3bcedbf544bfd621aabc477374781a27715c69b6a399f9392b4b54e76f3a47d/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-05-10 10:53:07 UTC
File Type:
Binary (Archive)
Extracted files:
103
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4o6o3p2ujp6wegvlyr3tor4buj3rlru3ni4z7e4sws2u45xtur6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3bcedbf544bfd621aabc477374781a27715c69b6a399f9392b4b54e76f3a47d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 e3bcedbf544bfd621aabc477374781a27715c69b6a399f9392b4b54e76f3a47d

(this sample)

Formbook

Executable exe 9e393967e94c1f667955493b1b23f0b74c732a46c4eaa04d6e13a51c33a17ab9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e393967e94c1f667955493b1b23f0b74c732a46c4eaa04d6e13a51c33a17ab9

Comments