MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e8e5f5e61e9fb0a9388df59d736188ea1f6ecdc50cd7b573fad240f63004fa00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e8e5f5e61e9fb0a9388df59d736188ea1f6ecdc50cd7b573fad240f63004fa00
SHA3-384 hash: f42be3588a149d4c85720604be22e7d40a8d8282959e2956e97ec1a2a8bceea4cacce529582f37de1605b264bc7a4ae2
SHA1 hash: f58699eccef0ac0d43a67b76bf01aa44dca8c1fc
MD5 hash: 2116e024dbeca2d83f5edfe2872f8611
humanhash: massachusetts-pasta-indigo-friend
File name:INQUIRY.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:492'317 bytes
First seen:2020-11-19 08:07:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KBiBYS2E6DRaEuQrolgdArr4BpEuiPBo1Y5cv6+:KBW2Ee9vugEZZo1YWv6+
TLSH 0BA423A87CC0534F2B90C97F5176A569289D2B907E87E132D05D7CDD92F8090F9E88EB
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.nc-hunicorn.com
Sending IP: 45.85.90.117
From: Allie Angel <AAngel@storetekeng.com>
Reply-To: Allie Angel <office@nc-hunicorn.com>
Subject: New Order
Attachment: INQUIRY.zip (contains "INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs264.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e8e5f5e61e9fb0a9388df59d736188ea1f6ecdc50cd7b573fad240f63004fa00/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 08:08:04 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5ds7lzq6t6yksoen6woxgymi5ipw5tofbtl3k4722japmmae7iaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip e8e5f5e61e9fb0a9388df59d736188ea1f6ecdc50cd7b573fad240f63004fa00

(this sample)

Formbook

Executable exe 2ad3891aeb09b03c1197267642a1dfbbab7ee5cfd61a426db27e3b7c7445fa35

  
Dropping
MD5 193b95fd6c89fdd4af095cbc0afdbc19
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ad3891aeb09b03c1197267642a1dfbbab7ee5cfd61a426db27e3b7c7445fa35

Comments