MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4
SHA3-384 hash: 51cff884e34f575ec35c8acea2ad743d919c3820fdde2eae3e561bd52bb318c00411fa0b8b4ac329f0588c90af603153
SHA1 hash: a9a12070243ccac09cbae2ce66fefd73e47acb04
MD5 hash: 6c14c52d7e2b4678db367f29fbc19685
humanhash: comet-river-bravo-oklahoma
File name:payment.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:194'159 bytes
First seen:2021-04-07 05:53:30 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 3072:OfGyfZzst58Rsm25VcgbPD27uOsZw0W4rnmCFFiULMDl5JqUVE+t:OfGS46s3bK7ulrnzF0MmN2k
TLSH 1D1412C397E5986A70BD532C04BA086A273C3054F9AE89379CE296DF5D342736191F3E
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.aw-himpelar.com
Sending IP: 185.121.120.70
From: 苟春艳 <melody@bototyre.com>
Subject: Payment Order for Invoice No 37996A
Attachment: payment.cab (contains "payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.25634.29940.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 01:19:01 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gwfauz7oy7oaykmxceo6mhi45t3b5hycwjcqxe6xuln45m7qitca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 358a0a67eec7dc0c2997111de61d1cecf61e9f02b2450b93d7a2dbceb3f044c4

(this sample)

Formbook

Executable exe 8412907b0441a1695b45e1de5e7b446d28ab00f6da416bdb2575f51eb60e9647

  
Dropping
MD5 a370ee00eb4fcf3536d27755099d2f71
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8412907b0441a1695b45e1de5e7b446d28ab00f6da416bdb2575f51eb60e9647

Comments