MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024
SHA3-384 hash: 357d92b1f8d0c0a1b498a0a4ace28a2df7c8daeaf4416b19d55abb556b2ad8018320324ac3cb6f3cb7abb7d385db52d4
SHA1 hash: d9e8334f8c87436860571cf7b9423f2c901dbbf0
MD5 hash: c8c9b369e614a962c27fd96b58db79e2
humanhash: east-carbon-bluebird-mars
File name:IMG_94301.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:584'784 bytes
First seen:2021-03-16 06:32:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:9yjBEffw1lfpq8jcD38lGRn1OETMxns2Y8hzFfStik1PrjbjYaBB:9yFEHwo803r16sZ8hzF6iwzpB
TLSH 91C4231C41FA2DBC62975593E1535FFC44D8B9B93A6F2E62E33A2A034FA1705CD8E042
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Jenny Jiang<Jenny.Jiang@bmo.com>" (likely spoofed)
Received: "from bmo.com (unknown [217.146.81.124]) "
Date: "16 Mar 2021 06:10:05 +0100"
Subject: "Remittance advice for lgpartner.ch"
Attachment: "IMG_94301.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1702.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25676.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22989.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 06:33:09 UTC
File Type:
Binary (Archive)
Extracted files:
84
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ke35z2mrok7dnihb34uwjvyicpss7pv6n5jiwzjn7pzc7l2ukasa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5137dce99172be36a0e1df2964d70813e52fbebe6f528b652dfbf22faf545024

(this sample)

Formbook

Executable exe 770710adcc9c97316e0f43dcc99ef1561dfe8ec086a1514d4c3d7d0d90b24181

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 770710adcc9c97316e0f43dcc99ef1561dfe8ec086a1514d4c3d7d0d90b24181

Comments