MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0594ca5eb4857e765bcef8e3e31687306ced4b62ca57f3efb4888de67296b0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0594ca5eb4857e765bcef8e3e31687306ced4b62ca57f3efb4888de67296b0f
SHA3-384 hash: b759006f93abf5b62207a49eefea7e189f754aae0a9d632a236c94325ede2cb0a15a38ea038d426188b8248f7704187f
SHA1 hash: d1d1f6a34cf254ef5856743c16282c85439e6405
MD5 hash: 9ac43a6f2a2fd794dc4fdacfa11e6b6f
humanhash: georgia-paris-illinois-south
File name:PO8479349743085.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:210'180 bytes
First seen:2020-10-20 08:23:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:Cprtzgx0+7o1DU9+9ufdPua/h6M/z9dSRL2UMRJGbuor7LP3v6AwyF2T0/cVcJLF:8t0m+PuahdSB2PJ+XrP3v6KJLzFEgF
TLSH B72423462C8338C24631A9FF7960315E97D1EE838F89ECB07026C3DC5A6D8AE2B554D7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.201
From: 杨玲 <sales2@teweiband.com>
Subject: PO8479349743085
Attachment: PO8479349743085.zip (contains "PO8479349743085.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.19007.3968.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0594ca5eb4857e765bcef8e3e31687306ced4b62ca57f3efb4888de67296b0f/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 04:05:01 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bmuzjpljbl6ozn456hd4mliomdm5vfwfssx6px3jcen4zzjnmhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f0594ca5eb4857e765bcef8e3e31687306ced4b62ca57f3efb4888de67296b0f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip f0594ca5eb4857e765bcef8e3e31687306ced4b62ca57f3efb4888de67296b0f

(this sample)

Formbook

Executable exe 8b50a9610f9fe8bce3874969c39932235dc3129a3ed7057a40241b44cbdfa0c5

  
Dropping
MD5 362d1d639612c0cf1b4bcf8a5faa0486
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8b50a9610f9fe8bce3874969c39932235dc3129a3ed7057a40241b44cbdfa0c5

Comments