MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42e64578d52a5f3de929393e7f81fe2082a387b15a5cd39663708f1709242653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42e64578d52a5f3de929393e7f81fe2082a387b15a5cd39663708f1709242653
SHA3-384 hash: 3a44555d0bed8ad3c36202c7bc1572d20143d464c9c5cd9101116cfcce730a33fae5f8a283da433754b4e9c325b10f24
SHA1 hash: 1174ab0b4f40256bd86200b60dc6512ba2076505
MD5 hash: 6dc08c1356ebd732038b1b128dd6aa77
humanhash: alpha-uniform-glucose-stairway
File name:PO2001721CMZ-UGUST2020ETD.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:477'688 bytes
First seen:2020-08-03 07:18:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:/4RHm7b/qqkrrk8jvJgMHseaTbSS2cjupfpvaE+kG:/Am77qXFJgMHATbz2cj63LG
TLSH 67A4230CBB2386E3DCF71BF1487957FC083DA902883C9A54F2BCE7A628764385D60695
Reporter abuse_ch
Tags:Endurance FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qproxy4-pub.mail.unifiedlayer.com
Sending IP: 66.147.248.250
From: Martin Ariel Castillero <info@compliancemodel.com>
Reply-To: jlm2005@ilmshoes.com
Subject: REQUEST FOR PROFORMA INVOICE FOR DEPOSIT proforma invoice
Attachment: PO2001721CMZ-UGUST2020ETD.rar (contains "PO2001721CMZ-UGUST2020ETD.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42e64578d52a5f3de929393e7f81fe2082a387b15a5cd39663708f1709242653/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 07:20:12 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iltek6gvfjpt32jjhe7h7ap6ecbkhb5rljonhftdochrocjeezjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/42e64578d52a5f3de929393e7f81fe2082a387b15a5cd39663708f1709242653

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 42e64578d52a5f3de929393e7f81fe2082a387b15a5cd39663708f1709242653

(this sample)

FormBook

Executable exe e9111465f64f15932c37cbcf81cc493a8f8abf34470670729f5b63bb48f7d31b

  
Dropping
MD5 f3d59d3f6e9b87dd7a0b8d751b15c44c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e9111465f64f15932c37cbcf81cc493a8f8abf34470670729f5b63bb48f7d31b

Comments