MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45a51d0b1b2e089da800659d4bba4d674866342eda0254949bb691d9ae8bbf55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45a51d0b1b2e089da800659d4bba4d674866342eda0254949bb691d9ae8bbf55
SHA3-384 hash: bc14e9053d72a112f6aea10bf2a12a7ac5a7c4bee31f9b1a085d694741763353bc07f4b3e5b6bb14a9d1e0accc252b26
SHA1 hash: d4fe3b4ab8f12b7939134fe637abcbb458635c50
MD5 hash: a1d994579aa88a9100e6166af79f437c
humanhash: green-minnesota-connecticut-oxygen
File name:05-08.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:235'043 bytes
First seen:2020-08-05 13:48:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:SU3yuU/qtAr4qaHprEudiOxu9tOPUn0Bpf95Dis:SU3riIRbFUOocf5DZ
TLSH 353423FB1F8702B175607B2E0BC5A98E78AB73F5587211BB758056F16D04DF09AE0C8A
Reporter abuse_ch
Tags:BBVA ESP FormBook geo zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.emothway.com
Sending IP: 45.95.169.243
From: BANCO BBVA <info@emothway.com>
Reply-To: BANCO BBVA <mailreply01@mail.com>
Subject: Aviso de pago: Ref. [GLV223170812] / Créditos ACH / Ref. Cliente: [18325_PK] / Ref. Segunda parte: [80015757]
Attachment: 05-08.zip (contains "05-08.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45a51d0b1b2e089da800659d4bba4d674866342eda0254949bb691d9ae8bbf55/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 13:50:08 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iwsr2cy3fyej3kaamwouxosnm5egmnbo3ibfjfe3w2i5tlulx5kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/45a51d0b1b2e089da800659d4bba4d674866342eda0254949bb691d9ae8bbf55

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 45a51d0b1b2e089da800659d4bba4d674866342eda0254949bb691d9ae8bbf55

(this sample)

Formbook

Executable exe db976b273e92b605275bbe6c8590f3ef6687faa0effc351a35d15af1f8fc1c3a

  
Dropping
MD5 52c8b4dbc001dd917dfd52ce2f7e00c5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db976b273e92b605275bbe6c8590f3ef6687faa0effc351a35d15af1f8fc1c3a

Comments