MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d7839b1ff8dd0f953e2a9e6bcb20e850db5d41df48d1f68c3914dafeb3ecc3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d7839b1ff8dd0f953e2a9e6bcb20e850db5d41df48d1f68c3914dafeb3ecc3f
SHA3-384 hash: 515e18e83fbdb04eb20aa63b66396b0eb41ed09722d4c051a9941cb5ac7ea9dc6f948ffdcade3b9a02838fadb03a4b57
SHA1 hash: 1073999a978bb61012cb1c8221c6453b2dc27661
MD5 hash: 7e647bcb1cdbba7b83cf5caa23d3c14d
humanhash: winner-lithium-magazine-music
File name:DB_ajdi838893noticeaArrival.img
Download: download sample
Signature Formbook
Create hunting rule
File size:630'784 bytes
First seen:2020-08-31 06:26:48 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:z/GjQ5dUhWUFZfXd7Me2s3NOP2/DCmuwKM:z/+QaWat7MK3N5L
TLSH 7AD4120EF3CDD550CBEDA17FAAB15193063BCAA9A0695E06F49CE1958B737508C242CF
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: kandeleria.ru
Sending IP: 82.202.197.90
From: autonotificationimports@maersk.com <info@mytechiesa.co.za>
Subject: Arrival notice 2034433081
Attachment: DB_ajdi838893noticeaArrival.img (contains "DB_ajdi838893noticeaArrival.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.10082.14321.22017.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d7839b1ff8dd0f953e2a9e6bcb20e850db5d41df48d1f68c3914dafeb3ecc3f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-30 22:13:49 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lv4dtmp7rxipsu7cvhtlzmqoqug3lva56sgr62gdsfg272z6zq7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5d7839b1ff8dd0f953e2a9e6bcb20e850db5d41df48d1f68c3914dafeb3ecc3f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 5d7839b1ff8dd0f953e2a9e6bcb20e850db5d41df48d1f68c3914dafeb3ecc3f

(this sample)

Formbook

Executable exe 7095eec286427d0c168ef01a9d20e741032194cd9e4fb607c02a55c0a1df29c5

  
Dropping
MD5 24c4953287f23b4a7854ec1ec98cebbb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7095eec286427d0c168ef01a9d20e741032194cd9e4fb607c02a55c0a1df29c5

Comments