MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52ec912e4b8eb208deb16eb81344b56d8550c06f34df6f89966e9df639ddc806. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52ec912e4b8eb208deb16eb81344b56d8550c06f34df6f89966e9df639ddc806
SHA3-384 hash: 5c42c04dc8cff20c1b3cd7861b259fb206a015a7dca4922881f786f73ad8f88b03f68e75a7f70eeaf5555693295dfa11
SHA1 hash: 722c461b9babb81799fcc28317e42bfa4508a3d2
MD5 hash: 3e20bd1f159bcec68ef224685d2071ce
humanhash: low-early-lemon-river
File name:neft_credit_.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:366'093 bytes
First seen:2020-06-16 05:09:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:9omEyPf5t7ktTHIRR7kPEuMMPFToK5hrKD8Qbizks1B2AZm09xWhEPU6ISVX:9zbf7iW2T9dToK5wZb3EZ9A4UoVX
TLSH 7B742362853CDB4ACA47B8F38FD6D134A7427AD65EDB61B8D033D009084B61B4C25BF9
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.wewinning.xyz
Sending IP: 45.95.169.89
From: neft@idbi.co.in
Subject: NEFT Credit confirmation
Attachment: neft_credit_.zip (contains "neft_credit_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:11:06 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=klwjclslr2zarxvrn24bgrfvnwcvbqdpgtpw7cmwn2o7moo5zada._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 52ec912e4b8eb208deb16eb81344b56d8550c06f34df6f89966e9df639ddc806

(this sample)

FormBook

Executable exe 1dfc6a7e787d82376ca07e3458408d28e72da11b07b01f9a438fa0a6948dc2f5

  
Dropping
MD5 4c056d174e7ef1ac8181b3ef788cccf5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1dfc6a7e787d82376ca07e3458408d28e72da11b07b01f9a438fa0a6948dc2f5

Comments