MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19917fc2c056ad8cfdf2b0bb24e2da8a5f8c9d1e8b23b8f5294af0bc3eb83aa3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19917fc2c056ad8cfdf2b0bb24e2da8a5f8c9d1e8b23b8f5294af0bc3eb83aa3
SHA3-384 hash: d3f7456b9118603ca6422cd91d77be2bca31781119f7bae218bfc6cddc117c1a1cdbbf89cf37788d7cb5078a4103c0e9
SHA1 hash: 928062de77bb9c19e9f281e8a7618b76709bc510
MD5 hash: b5f40b82d9077a0a7460947fb64ebab5
humanhash: mango-montana-quebec-december
File name:Purchase_Order.r00
Download: download sample
Signature FormBook
Create hunting rule
File size:454'872 bytes
First seen:2020-08-18 12:48:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9TB0KlNFKxOP2sJrEqi8iW2QUKEIIcAUAiL5lF/sTU9i:VuciW2QMVDshaqi
TLSH 65A423A9ED96F66050A53613CC6787041FE8F1B6FD0DE4C9910638815E352EFEC2BA63
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Shantharam Dayanand Shanbha <support@haisokbr.go.th>
Subject: Quote Order
Attachment: Purchase_Order.r00 (contains "Purchase_Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20995.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19917fc2c056ad8cfdf2b0bb24e2da8a5f8c9d1e8b23b8f5294af0bc3eb83aa3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 12:50:06 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dgix7qwak2wyz7pswc5sjyw2rjpyzhi6rmr3r5jjjlylypvyhkrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/19917fc2c056ad8cfdf2b0bb24e2da8a5f8c9d1e8b23b8f5294af0bc3eb83aa3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 19917fc2c056ad8cfdf2b0bb24e2da8a5f8c9d1e8b23b8f5294af0bc3eb83aa3

(this sample)

FormBook

Executable exe d05efc3d09d7c08668da10c09101815e0af2f3376a03512e959ca467835b9c26

  
Dropping
MD5 5002a991471b277ea20d38b61c81ce60
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d05efc3d09d7c08668da10c09101815e0af2f3376a03512e959ca467835b9c26

Comments