MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6923c6b53ceaec1d925149106d9d29c7d35af3542beca0bcbd9333f4ea28e67b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6923c6b53ceaec1d925149106d9d29c7d35af3542beca0bcbd9333f4ea28e67b
SHA3-384 hash: 343d364270aed35925d405e7b3ae8991a7386e576142608ae8b6f71c5b43f9044b4ae100f85f3b058c9e302ef1a05733
SHA1 hash: 4724e111f096b404014e26f00a3a7a7bc14f9a49
MD5 hash: 949e3fdfe6efdb89fff9d5644f574f93
humanhash: california-mars-william-queen
File name:request for quotation samples No 48576935 96877463.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:325'120 bytes
First seen:2020-08-11 14:10:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:FhTE/qNKgmHtW5gahj6wItu/njNyeto+G86PjmsynQoo1SF:Fhw/qNKgmNbah2XcnjNBG867XynG1SF
TLSH B36423A12F87F6B61E00D51A22BA8D5794AC498714370843A17BF13E13FCFDE9799836
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: 176.113.83
Sending IP: 176.113.83.183
From: INQUIRY | CHIMATEK S.P.A <chimatekspa@mail.com>
Subject: PURCHASE ORDER
Attachment: request for quotation samples No 48576935 96877463.gz (contains "request for quotation samples No 48576935 96877463.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Fareit-FYE6CEB03B6435E.4487.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6923c6b53ceaec1d925149106d9d29c7d35af3542beca0bcbd9333f4ea28e67b/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 14:12:06 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ner4nnj45lwb3esrjeig3hjjy7jvv42ufpwkbpf5smz7j2ri4z5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6923c6b53ceaec1d925149106d9d29c7d35af3542beca0bcbd9333f4ea28e67b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6923c6b53ceaec1d925149106d9d29c7d35af3542beca0bcbd9333f4ea28e67b

(this sample)

Formbook

Executable exe b32579e01c28fc0a157f14ce8c679d02fcd1f5c03f8eef56ba6a77a627786d84

  
Dropping
MD5 6ceb03b6435eefad76639a03a22ce0fb
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b32579e01c28fc0a157f14ce8c679d02fcd1f5c03f8eef56ba6a77a627786d84

Comments