MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb6f89bae4fa461dfea91ca99563c4fd0ef8d3e5d876eb8e1944c99c6ce75760. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb6f89bae4fa461dfea91ca99563c4fd0ef8d3e5d876eb8e1944c99c6ce75760
SHA3-384 hash: cc26ee42f4e3f9c52b89f3b151453dd56ed6e15396892b4778e365e73a181179e25862a006e8f99d7a2f3efb0802e29a
SHA1 hash: 1eefa51d0062c172b99d83a3bf01ac3841dfe678
MD5 hash: a415015a05200548a1b6deda94d13efe
humanhash: west-crazy-asparagus-purple
File name:P.O. 20388-RI.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:300'316 bytes
First seen:2020-10-06 06:10:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ZxzcqwBJS7f6OiqIrPTMpEiiN9Fym+fMO3pQmySaYtJ4mtN0tDPxB/IswA:bzXtazropEiinFHgp1nJtJZN0tDPxBA6
TLSH B654238C5B5CDAE27F136796810B03DF1DA4C3E9A9D8157FC0BAFA10CA931BAE106135
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: atl4mhob23.registeredsite.com
Sending IP: 209.17.115.117
From: rr <rr@educationaldecisions.com>
Reply-To: rr <rr@educationaldecisions.com>
Subject: New Order & Inquiry
Attachment: P.O. 20388-RI.zip (contains "Inquiry.pdf")

Intelligence

File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb6f89bae4fa461dfea91ca99563c4fd0ef8d3e5d876eb8e1944c99c6ce75760/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-06 02:54:39 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5nxytoxe7jdb37vjdsuzky6e7uhpru7f3b3oxdqzitezy3hhk5qa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb6f89bae4fa461dfea91ca99563c4fd0ef8d3e5d876eb8e1944c99c6ce75760

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip eb6f89bae4fa461dfea91ca99563c4fd0ef8d3e5d876eb8e1944c99c6ce75760

(this sample)

Formbook

Executable exe e3dbbb858177e3f3bae3fd5501eb0c8d4109ed87b534dc97e50a2142f616201a

  
Dropping
MD5 0a8825c8efd3aa13a9994a6baeba60f5
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3dbbb858177e3f3bae3fd5501eb0c8d4109ed87b534dc97e50a2142f616201a

Comments