MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6656741ace870d4bdc2258255f94b7d34e2d596af1b3e08755331b3e60771a8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6656741ace870d4bdc2258255f94b7d34e2d596af1b3e08755331b3e60771a8e
SHA3-384 hash: fbbd353b7d9dc5b572eb20b1399f61fb2e1b1bb5ec9bb0dbc2cac423b5b06c6c17a1d7da3175ce202c89529134175e6e
SHA1 hash: eeffed660c4db3b31eda8f34ccb1d7fae892723f
MD5 hash: 42657d8af3286f2f09d7ba28bd45190e
humanhash: fruit-connecticut-lake-saturn
File name:Requirement of Sonic Tube 50 mm.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:239'528 bytes
First seen:2021-02-26 06:53:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:1KjfGVw6gXnIdCljqVErYoMmi4Sxi+M0WYSGGm7:cz6gXCClmVFoMmPS4jYr7
TLSH 4D34236B52BBFC33DBA1BDF96E02B4C5CFAA3812762B534922D05115E206B61BD0F5C1
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: business117-1.web-hosting.com
Sending IP: 162.0.215.250
From: support@haacxx.club
Subject: RE: Requirement of Sonic Tube 50 mm
Attachment: Requirement of Sonic Tube 50 mm.zip (contains "Requirement of Sonic Tube 50 mm.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6656741ace870d4bdc2258255f94b7d34e2d596af1b3e08755331b3e60771a8e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 05:43:24 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzlhigwoq4guxxbclasv7ffx2nhc2wlk6gz6bb2vgmnt4ydxdkha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6656741ace870d4bdc2258255f94b7d34e2d596af1b3e08755331b3e60771a8e

(this sample)

Formbook

Executable exe c1a40dbca9d28ac760447f501d812b82312be281ee699fdcc4a6a543077caa3d

  
Dropping
MD5 5e51248701b8a456d39854abfe287c86
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1a40dbca9d28ac760447f501d812b82312be281ee699fdcc4a6a543077caa3d

Comments