MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58ae502d775314dc44f061f90d10399a7d1eefeec5b6450c73ae916be34f8ffa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58ae502d775314dc44f061f90d10399a7d1eefeec5b6450c73ae916be34f8ffa
SHA3-384 hash: b1d95fbb617792d6adf2624dd237026d1ec693980bd6465a257bc1baf6296e2cf3bf5de3986e76d5579b2c7d20aa22f3
SHA1 hash: c0e9dc05718d2e34a832c5a638ce8af4bc2b711a
MD5 hash: 7e40165da9e81463b77b2e2344568087
humanhash: island-montana-hamper-zebra
File name:payslip.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:294'930 bytes
First seen:2020-06-17 06:09:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+4SIDF7mbTRMGGqzoWQiL7HqfNsKo0o9xI22+Gna4ejnmtZ:9SI7mbTGY6fNro0sH2+Ga4eSZ
TLSH A954231060367F4645C1C69C62185036BDFCAB4DA921927BCC502972B38EBCFD4E27AF
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.mcleeria.com
Sending IP: 45.95.169.81
From: TLS SDN BHD <info@mcleeria.com>
Reply-To: TLS SDN BHD <mailreply01@mail.com>
Subject: BANK IN SLIP
Attachment: payslip.zip (contains "payslip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21675.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 06:11:05 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcxfallxkmknyrhqmh4q2ebztj6r537oyw3ekddtv2iwxy2pr75a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 58ae502d775314dc44f061f90d10399a7d1eefeec5b6450c73ae916be34f8ffa

(this sample)

FormBook

Executable exe c128856d5c14b0bdf9b327cc2abbec30cfdfb5c0692f7ac57bc22551037da339

  
Dropping
MD5 71d576e94e3417d6cb92868a5f11d6e4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c128856d5c14b0bdf9b327cc2abbec30cfdfb5c0692f7ac57bc22551037da339

Comments