MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 206bdbb5c9dc76c9ec8e004d90aee02176624904985b0bd38bc11aeee166a49f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 206bdbb5c9dc76c9ec8e004d90aee02176624904985b0bd38bc11aeee166a49f
SHA3-384 hash: 0d1c4f9007b36b07b055ae23b5f4199f3677f4f6c9a3b189c80f9bb41f3a598b89a3a6b6031cf485ba00663b55abb81e
SHA1 hash: 5bc0f71637ffeab8c52702c015d88e590c6de131
MD5 hash: 7c68264f4480b8f8f2f84ae83f86ce24
humanhash: mobile-spaghetti-fanta-alanine
File name:dơn hàng mới.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:325'690 bytes
First seen:2020-08-17 08:52:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:F/L94I21LIuiCswXCeTrqyMLGM5VnBwylUoULzWaM3vtRacTgsoEsk:121LIulSeTrzWrLBwroULzWayvCbK
TLSH 156423A91F8DB88843615CE08458727BD40DEC26ED3C6B171EDD1D80AD7BE1818ADAF7
Reporter abuse_ch
Tags:FormBook geo VNM zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Thanh Nguyen <info@makino.eu>
Subject: Re: Re: yêu cầu đặt hàng mới
Attachment: dơn hàng mới.zip (contains "dơn hàng mới.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.69508.23030.11108.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/206bdbb5c9dc76c9ec8e004d90aee02176624904985b0bd38bc11aeee166a49f/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 08:54:06 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebv5xnoj3r3mt3eoabgzblxaef3gesietbnqxu4lyeno5ylguspq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/206bdbb5c9dc76c9ec8e004d90aee02176624904985b0bd38bc11aeee166a49f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 206bdbb5c9dc76c9ec8e004d90aee02176624904985b0bd38bc11aeee166a49f

(this sample)

FormBook

Executable exe f19931c3ed4df0c75c53daf0e7af1cfe86fc369b0fe99c1557f0b3708a78e868

  
Dropping
MD5 b16eb71ecd7e7e9e9c0a558d60454f60
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f19931c3ed4df0c75c53daf0e7af1cfe86fc369b0fe99c1557f0b3708a78e868

Comments