MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d86757e20cdd1a7e617071cc4149a509f22ed6b14118ce543809f42f0f6bdf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d86757e20cdd1a7e617071cc4149a509f22ed6b14118ce543809f42f0f6bdf2
SHA3-384 hash: 524bfb2db069da8158170045ada00feed507fe0ab8c59ca210cee02e94e028dbe6511a033a2555dc2f835171f07454a5
SHA1 hash: 2d84aa466b5379b5d82327247baa7d149d3d7833
MD5 hash: 6d34f7f0b8a0653bf8bcda091d513289
humanhash: comet-virginia-grey-grey
File name:quote107.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:872'692 bytes
First seen:2020-08-05 08:48:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:VM08kJRMVL1PeeB8LImeyrZ+YZPvDwFAezA:VMwu1PaIryrZlt0FAezA
TLSH 0405338A1F9E32D381C3C3D8A592AF506C56D9324269005F366DB26CD53E6CE4CC5EDB
Reporter abuse_ch
Tags:Endurance FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Daniel Chen <server@hinet.net>
Subject: Immediate quote required
Attachment: quote107.zip (contains "quote107.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d86757e20cdd1a7e617071cc4149a509f22ed6b14118ce543809f42f0f6bdf2/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:50:07 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwdhk7razxi2pzqxa4omife2kcpsf3llcqiyzzkdqcpuf4hwxxza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d86757e20cdd1a7e617071cc4149a509f22ed6b14118ce543809f42f0f6bdf2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3d86757e20cdd1a7e617071cc4149a509f22ed6b14118ce543809f42f0f6bdf2

(this sample)

Formbook

Executable exe b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f

  
Dropping
MD5 6577e654e8f6e34a2f486f9df3f9c9cf
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f

Comments