MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 407d56f25106b346313d71ef109309b3124baa949838fd1d91dbd8dcf8e73054. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 407d56f25106b346313d71ef109309b3124baa949838fd1d91dbd8dcf8e73054
SHA3-384 hash: 3da3726c2465614d97a7c05c127f165c2e34cfaca52dabd4650e5ae26d6274a78d3c58a44b286ac1401906f31458c776
SHA1 hash: 0345fbdd3a4413d83b3479db1d88122e4e070803
MD5 hash: 5c22e3e613ee6d4bcef69ca2270438a6
humanhash: eight-papa-coffee-double
File name:AWBInvoice INA101970.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:669'111 bytes
First seen:2020-12-29 08:03:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:cKQ4eEWJnEup7qV+rDkDgiOPXBjQ7h+j0yz5tEkfLBDDemWdPE00NbYqNZhA2I7O:ebEWCupeV+vkmNQl+7HEsLx6mWdPgNbB
TLSH 4AE423124AB6BD374DDBFBE784E94490D919CDC3E6251C22635C1F24238E26B674B3AC
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dhl.com
Sending IP: 79.110.52.80
From: Lee, Corinna (DHL) <corinna.li@dhl.com>
Subject: DHL Express Courier Shipment Confirmation AWB No.618-76731333
Attachment: AWBInvoice INA101970.zip (contains "AWBInvoice INA101970.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/407d56f25106b346313d71ef109309b3124baa949838fd1d91dbd8dcf8e73054/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-29 08:04:09 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ib6vn4sra2zummj5ohxrbeyjwmjexkuuta4p2hmr3pmnz6hhgbka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Spyware
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/407d56f25106b346313d71ef109309b3124baa949838fd1d91dbd8dcf8e73054

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 407d56f25106b346313d71ef109309b3124baa949838fd1d91dbd8dcf8e73054

(this sample)

Formbook

Executable exe 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4

  
Dropping
MD5 f52ccec51065d5d653daf93081f1fd0a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c3b63765f896c6e5faf093f002fa0f854994a1ea028a9abf53e7fdc8a3f18a4

Comments