MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025
SHA3-384 hash: 1eccbb17d18098038980d3e38f6ddad0246dc8a25a070a03ec49407794ce223fc39dd7022ed592569742086d39a36266
SHA1 hash: 9143b3372a32c79f06f8b8cc3098f390a0db17d7
MD5 hash: d114e8d71cc065c1019da2c071c9541c
humanhash: may-kentucky-kentucky-victor
File name:PO0932083943974.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:281'478 bytes
First seen:2020-07-21 07:39:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:fIPmh+GhAjAoKS0WK3hx4U0TfmSXh5PsWoQhNmy5GBmnHDi9eC/a:APmhPAjOWyxz0qSvsWXhN7RLCC
TLSH C9542389C398B010DE0D2EAF5F9D7543B09D34C0AB1C1B545CD964B72BF65BA88FE229
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.196
From: Michael <michael-cui@haixin-crafts.com>
Subject: PO0932083943974
Attachment: PO0932083943974.zip (contains "PO0932083943974.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:41:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgx7iwn2xl2erdvjbnpidzddarguvu5yuf5dx7fsi5zfukenwasq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 39aff459babaf4488ea90b5e81e463044d4ad3b8a17a3bfcb247725a288db025

(this sample)

Formbook

Executable exe 0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690

  
Dropping
MD5 cc034757c9d872b0a95e4a67967e50ac
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0047270c26f603d132bc8e6a67894311356fe2d3c977aa287a09a8261f6b5690

Comments