MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14f480156193373f75cf0edd27ce49ef37da2ef09656b3a59d199c2d7ff97456. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14f480156193373f75cf0edd27ce49ef37da2ef09656b3a59d199c2d7ff97456
SHA3-384 hash: 483a3da0903908ead5eb860c045489c5c4e6834a8747d8fb47e18e28c0d8563479a83ad75a79d9e1509ddaa5d1c3a025
SHA1 hash: 94faf66bbbecf7d6f452d2ead22204a5b7a37ed2
MD5 hash: 0ff027abb20ceb734dabbbcb12fb1eb9
humanhash: mobile-chicken-uncle-monkey
File name:supporting documents.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:578'155 bytes
First seen:2021-03-12 16:17:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:gsur7LQrmZsqf/jLqtOJjpAsV+ZDR/5q4I+mHQVRJq8Sijy6:m/LQqVfHpAsVY9/5q4I+/RnSO7
TLSH 0EC423DB1F9F588CC04E2BC49A89BC17DDBF64245ADE3101F7A81908463D79AAE8D347
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Thanh Ngoc Nguyen"<sales-es@acalbfi.es>" (likely spoofed)
Received: "from [203.159.80.7] (unknown [203.159.80.7]) "
Date: "12 Mar 2021 17:07:18 +0100"
Subject: "supporting documents"
Attachment: "supporting documents.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisEA4E28BA4820.8501.24391.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14f480156193373f75cf0edd27ce49ef37da2ef09656b3a59d199c2d7ff97456/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-12 16:18:06 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ct2iaflbsm3t65opb3osptsj5435ulxqszllhjm5dgoc277zorla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14f480156193373f75cf0edd27ce49ef37da2ef09656b3a59d199c2d7ff97456

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 14f480156193373f75cf0edd27ce49ef37da2ef09656b3a59d199c2d7ff97456

(this sample)

Formbook

Executable exe f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f39b9e8c4a9aa6d8cd9f069e8a8ee81a3f666e07071f2b4673aa42633026736c

Comments