MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ccd84dfd0b4218684b239d4a71888383944375fb39ab06411a467931ff37627. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ccd84dfd0b4218684b239d4a71888383944375fb39ab06411a467931ff37627
SHA3-384 hash: c45c4219a687ccbcd777da501a0aebf5cc361648f9d6624904dea0d91fdc01baf75fff5bf20b5bf054fb8800e2139acf
SHA1 hash: 5c76e4dd41f2746a519e9e591542493a5123249b
MD5 hash: 73d74397fd9f64d9590fe16f8503ef1d
humanhash: bluebird-steak-uranus-yankee
File name:REQUEST FOR URGENT QUOTATION ....zip
Download: download sample
Signature FormBook
Create hunting rule
File size:428'253 bytes
First seen:2020-08-19 11:19:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9ThfvGoAP4+N14357/ue7WuDUb1xyUk310bTKw:9NfnAA043F/bWuYbtNOw
TLSH 629423D8CFC7B9A0C7EE5E987198826F9001028F932D377F191CEBE45B4181366E566B
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps38753.inmotionhosting.com
Sending IP: 144.208.65.147
From: Mohammath Afrath <afrath@polarismep.com>
Subject: QUOTATION REQUEST
Attachment: REQUEST FOR URGENT QUOTATION ....zip (contains "REQUEST FOR URGENT QUOTATION ....exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ccd84dfd0b4218684b239d4a71888383944375fb39ab06411a467931ff37627/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:00:17 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtgyjx6qwqqynbfshhkkogeiha4uin27wonlazarurtzgh7toytq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4ccd84dfd0b4218684b239d4a71888383944375fb39ab06411a467931ff37627

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 4ccd84dfd0b4218684b239d4a71888383944375fb39ab06411a467931ff37627

(this sample)

FormBook

Executable exe e38a459f721050cdc6779172eeda9caa5496f144e41fce503ca01554ada0a64c

  
Dropping
MD5 3d864ddd48403f276e85010a6b452eba
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e38a459f721050cdc6779172eeda9caa5496f144e41fce503ca01554ada0a64c

Comments