MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 66603d3bbbec17c6c2725e49bcc8b84916a514d1e05835ff3ce92540d4c0f212. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 66603d3bbbec17c6c2725e49bcc8b84916a514d1e05835ff3ce92540d4c0f212
SHA3-384 hash: 3b5c1be3bc92750fb4e729e3f3067b75720a01c882740824dd22b62d4b7499286ca65a1aeac60094f14693cb0ef5461d
SHA1 hash: 41722e9a09ce5989eb663a0c80aa6d6970fe9b2f
MD5 hash: f62e88a9bd4b12616068c2da1d25f383
humanhash: massachusetts-carpet-alpha-fillet
File name:Mediform S.A Order SpecificationRequirement.xls.z
Download: download sample
Signature Formbook
Create hunting rule
File size:588'053 bytes
First seen:2020-10-14 15:04:09 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:X7A0t9P2CD9S0jDFFI1Q7mM/C6RhKKGevIHmSMiUt4XVz1pYkQ:ft9+CD9JnrI27REkgGS3HXVz1/Q
TLSH B9C4334B6BDE477273FD42B8C0883AFE0A5F2C366A04E113A857513726396D5F9D0B1A
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: desar.xyz
Sending IP: 67.205.150.177
From: Mediform S.A<mediform.s.a@hotmail.com>
Subject: Re: Request For New Inquiry RFQ
Attachment: Mediform S.A Order Specification Requirement.xls.z (contains "Mediform S.A Order Specification Requirement.xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/66603d3bbbec17c6c2725e49bcc8b84916a514d1e05835ff3ce92540d4c0f212/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 00:13:49 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzqd2o535ql4nqtslze3zsfyjelkkfgr4bmdl7z45esubvga6ija._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/66603d3bbbec17c6c2725e49bcc8b84916a514d1e05835ff3ce92540d4c0f212

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z 66603d3bbbec17c6c2725e49bcc8b84916a514d1e05835ff3ce92540d4c0f212

(this sample)

Formbook

Executable exe 0040dd5bbff90801dacfa809df431ebbf40ea1008eebe95fbeb718433bfe71cc

  
Dropping
MD5 291bd6d7a655d6b096922115199965af
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0040dd5bbff90801dacfa809df431ebbf40ea1008eebe95fbeb718433bfe71cc

Comments