MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42bab315ee33a0494ac09f8dbce44822d9c6206069e02c7a6e71828a6b85e7c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42bab315ee33a0494ac09f8dbce44822d9c6206069e02c7a6e71828a6b85e7c1
SHA3-384 hash: 1e2c54d86b678ba6fbd2ec0ae6ccff684d368c6d8d7a9705628f3e27f15703e15252f3ddce96e912a838c7ba1c8879d9
SHA1 hash: 083aa35541f9e205ab89f703e6ee66c94b47ad52
MD5 hash: a07b556663154b42fa448ce48c212b35
humanhash: jig-oxygen-magnesium-three
File name:URGENT-RFQ6532-JUNE2020.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:376'001 bytes
First seen:2020-06-11 06:13:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gMlIcnTENZzFOUWQyhScqKLaKwbtpw1ULUF/qNUP3L3cJ0nTZnJ:gynTENZzFhWQyjq9Xw1+URqNGK6TP
TLSH 1A8423D8682E73CB03487EF33F8E94358EE9855991ACD4DC33A06EDFC6517960242E66
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Hari Khalsa <vonploetz@hannover-marketing.de>
Reply-To: david@kelichna.com
Subject: Re :KN95 MASK -SURGICAL MASK, NITRILE GLOVES URGENTLY NEEEDED
Attachment: URGENT-RFQ6532-JUNE2020.rar (contains "URGENT-RFQ6532-JUNE2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:15:12 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ik5lgfpogoqesswat6g3zzcielm4midanhqcy6toogbiu24f47aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 42bab315ee33a0494ac09f8dbce44822d9c6206069e02c7a6e71828a6b85e7c1

(this sample)

Formbook

Executable exe 8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f

  
Dropping
MD5 e2a5e6e8c1448dfcaf7ae95dff95ade9
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8e0003e4f6d537153e60ac5129859a33b57b3b9a36b7d2be62273a6b3a8d5f3f

Comments