MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d75b1f8f171c7c17ba06a38532e32934464f176c3a81f964f7df449bf8243fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d75b1f8f171c7c17ba06a38532e32934464f176c3a81f964f7df449bf8243fa
SHA3-384 hash: ba33868cc3a5506ff5f5763b6896b672ff7446b8654210823df661b52a319ccde19a751a35e25440e507709e2662578c
SHA1 hash: 97eba67d87b29dfc5f5d99273f2f0103462ef041
MD5 hash: 0a533316b53d38268cccdaca7480163e
humanhash: may-golf-finch-asparagus
File name:Quote45.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:431'659 bytes
First seen:2020-08-13 04:35:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yI4XxtzSU+dgejpbdICKI/bY6FJoNNDw7poj/3L:yLLSUGjBeC/Ju87yTL
TLSH FB94233D0880669F4AFF33E6BE5F4755C709AA917ED203684D903C9A41BC32A55E62FC
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email
From: Helen He < server@hinet.net>
Received: from 162-241-204-248.unifiedlayer.com (unknown [162.241.204.248])
Date: 10 Aug 2020 19:15:49 -0700
Subject: Reminder for Quotation
Attachment: Quote45.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.50105.21332.13397.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d75b1f8f171c7c17ba06a38532e32934464f176c3a81f964f7df449bf8243fa/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 03:29:38 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hv23d6hrohd4c65ani4fglrssncgj4lwyoub7fsppx2etp4cip5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d75b1f8f171c7c17ba06a38532e32934464f176c3a81f964f7df449bf8243fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3d75b1f8f171c7c17ba06a38532e32934464f176c3a81f964f7df449bf8243fa

(this sample)

Formbook

Executable exe fa2fea7b2c7e6d02c40890b178133c0c21e6e1182c170c09de4550e85c98e67f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa2fea7b2c7e6d02c40890b178133c0c21e6e1182c170c09de4550e85c98e67f

Comments