MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb
SHA3-384 hash: 155da2e719f267e3404a365d97157afa8ddaa4d3010aaecd0d37071589cba105ae6302274966df7ab34dd62300d8fe5e
SHA1 hash: 6c8d668dd5679cb06a77c9427d3a86861e7c7857
MD5 hash: 110f6ccb4b895841544a8aee876a4183
humanhash: hamper-fix-victor-pasta
File name:SIN_TONG_HWA_TRADING.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'966'080 bytes
First seen:2021-02-26 06:52:03 UTC
Last seen:2021-02-26 06:52:05 UTC
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:h+I2NRYBCLVR6WeIH56jY4dmhtEGDo82Std3iKx4HW:YIOx6jE+q1TP
TLSH D3950C039C098B87E42883F8BD074DAC1F562B1CE8923AFF50665EDB7E752121C5E56E
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns4.leaseweb.net
Sending IP: 213.227.149.147
From: Nurul Ain <ain@jpp.com.my >
Subject: Product Inquiry
Attachment: SIN_TONG_HWA_TRADING.IMG (contains "Doc_3957495686846574893974939464936488463936484,pdf.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 23:30:08 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=frfgctzoyvp2ineyhwuxldrzwitxd3nhnzze5iy2shx4mgcpwpvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 2c4a614f2ec55fa434983da9758e39b22771eda76e724ea31a91efc6184fb3eb

(this sample)

Formbook

Executable exe 3a220e6bff537b270991d1bb49e530c7279fb643f8a9b5998bbefae6140a19f4

  
Dropping
MD5 1662b1ff6de1371a09ecabb5a2c14905
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a220e6bff537b270991d1bb49e530c7279fb643f8a9b5998bbefae6140a19f4
  
Dropping
SHA256 c0edc415e1c08532783562faf5434e866087e82e257283fc3b0bb0081b040f24
  
Dropping
MD5 31a018d815f0d317b090665f3c4050e8

Comments