MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a46953f27918ea1df72ba9df13cca2df2eda8b32db95d72be1aceb184417c7d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a46953f27918ea1df72ba9df13cca2df2eda8b32db95d72be1aceb184417c7d
SHA3-384 hash: f3bdc582e04787732b6b17c2453695e0acbbbb43e59551fe6aaf01721e5dfcdd1add9d14579b4838aec3d67ec9895453
SHA1 hash: bfdb121407126b2e37de1240a785e6436a0b3e09
MD5 hash: ad5ab1fb4b4dea316cd3a158d30611f7
humanhash: freddie-nuts-salami-carbon
File name:Prueba de pago.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:1'091'733 bytes
First seen:2021-01-15 15:49:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:mdLs6m8ftrtN/uPOc3krzTTlSXJE+K/ba/e/qjQ786PuCdz2fXutF5EuuT:cOYN1BSX6+Kz5ijihdzG+tF5E3
TLSH E335336C14FD95F37E94C82AB1B2381436ADFEDAEA00189415E5241D5BCB3B4B77F02A
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: srv.barakaldotiendaveterinaria.es
Sending IP: 149.202.92.158
From: ventas <ricardosimian@hotmail.com>
Subject: RE: Envío
Attachment: Prueba de pago.zip (contains "Prueba de pago.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a46953f27918ea1df72ba9df13cca2df2eda8b32db95d72be1aceb184417c7d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 13:44:59 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjdjkpzhsghkdx3sxko7cpgkfxzo3kftfw4v24v6dlhldbcbpr6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a46953f27918ea1df72ba9df13cca2df2eda8b32db95d72be1aceb184417c7d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3a46953f27918ea1df72ba9df13cca2df2eda8b32db95d72be1aceb184417c7d

(this sample)

Formbook

Executable exe 5f788a4f3f135a5a5533ed8f83871369850b790f9114ecd672421f171a9b8000

  
Dropping
MD5 359c5a9a6b7fa741ce70c1f38a27d9b2
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5f788a4f3f135a5a5533ed8f83871369850b790f9114ecd672421f171a9b8000

Comments