MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ae0cabdbcaf3a578ce6e9f8f5b9b3b700fc5b7fcfef019f9daf53352fb5d9e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ae0cabdbcaf3a578ce6e9f8f5b9b3b700fc5b7fcfef019f9daf53352fb5d9e3
SHA3-384 hash: 9580dcaeae86c7ac17293bd911bacf74ad015e06cc27a78f87623a7df7dfe3237434eb1f90e710c1eedcd46705905b85
SHA1 hash: aecd8debbb4c223da8a4083ff77c2741413bfd65
MD5 hash: e945de3f7c3f19fc3974adab6d0ac9dd
humanhash: twenty-diet-iowa-white
File name:PO 4415902670.xls.z
Download: download sample
Signature Formbook
Create hunting rule
File size:319'800 bytes
First seen:2020-11-26 06:44:20 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:goOtrBR6g6EfWHINU+cnh6hyK9S61zqL/FlURZDL97Dsj2IbH:gBrBvVeH+1qshx9SaE+NxnyXH
TLSH BD6423B088E599DF31780107642F6A86DE439D0A7074FA7B334E1E7C486E852E4957EF
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sopo.com
Sending IP: 103.225.25.31
From: Suma S <sales@adamvital.ae>
Subject: PO# 4415902670
Attachment: PO 4415902670.xls.z (contains "PO# 4415902670.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ae0cabdbcaf3a578ce6e9f8f5b9b3b700fc5b7fcfef019f9daf53352fb5d9e3/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-26 06:45:05 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=blqmvpn4v45fpdhg5h4plontw4apyw37z7xqdh45v5jtkl5v3hrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 0ae0cabdbcaf3a578ce6e9f8f5b9b3b700fc5b7fcfef019f9daf53352fb5d9e3

(this sample)

Formbook

Executable exe ad644da69f848609475d2a3d773eadf646d4c1e1cb20e4b87422d224e2ccbe32

  
Dropping
MD5 058e6f06a51e22bbc975eecf35c34844
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ad644da69f848609475d2a3d773eadf646d4c1e1cb20e4b87422d224e2ccbe32

Comments