MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3135a8df1547e8ebd4b0bd048f3e4d0e5e6c0fe2f99b90b80f09a17be4cb364. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3135a8df1547e8ebd4b0bd048f3e4d0e5e6c0fe2f99b90b80f09a17be4cb364
SHA3-384 hash: 695ea986b0fb99683e30d7e49728aff91ff12e43f15f603db7b3f6ca6ffbf0b5e5aa73bfb461e1a507f528431d35376f
SHA1 hash: 6b84d638b4619bff67b3077c11900b8318daf1c3
MD5 hash: f2f49b8cea58408e80b277a20d1f02ff
humanhash: fanta-ohio-echo-table
File name:slip copy.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:562'418 bytes
First seen:2020-07-13 11:40:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:O+mePwFjrOoAabJpv0ukFQIJR7QcAImTKh/QwQuqhIggRRG:O+fPMfOusuQ/7DA5VuLgSG
TLSH 1CC423B2ED61820180E819F23298F6FC4B174FF1D75562B847682F2A78C3CDA9935DD9
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: spock.gnoft.com
Sending IP: 176.9.117.66
From: mahmoud alkassem <ahmed.badawy@wataniasystems.com>
Subject: Re: Odg: Re: Odg: Re: Odg SWIFT USD 87700,000 20200710113303
Attachment: slip copy.zip (contains "USD 87700,000.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis818F7516F05F.2157.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3135a8df1547e8ebd4b0bd048f3e4d0e5e6c0fe2f99b90b80f09a17be4cb364/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:42:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2mjvvdprkr7i5pklbpier47e2ds6nqh6f6m3sc4a6cnbppsmwnsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip d3135a8df1547e8ebd4b0bd048f3e4d0e5e6c0fe2f99b90b80f09a17be4cb364

(this sample)

FormBook

Executable exe 35bb2187c8bcf8921677dc34a4a3bf7f33144c97370346f4ff616c82a2e278b5

  
Dropping
MD5 818f7516f05f3031b20c0300649e5c01
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 35bb2187c8bcf8921677dc34a4a3bf7f33144c97370346f4ff616c82a2e278b5

Comments