MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69fe13f4286f7e67ea6c10fc852f9afa4065271577190f6523536a3947dac82d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69fe13f4286f7e67ea6c10fc852f9afa4065271577190f6523536a3947dac82d
SHA3-384 hash: 7076ecc1b7f077c7628fac0296e95b0c7b5fbadfeae151deb46d70bcd90c891cab5f10d2d6681c662b76e6c03b79391e
SHA1 hash: 0cc8c4b161cbba7412138edb80c0dfe4f349715f
MD5 hash: 0bcfa393fbe5f15c13dd6e9e819a4583
humanhash: cup-nuts-beer-hawaii
File name:Parker Hannifin Corporation.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:732'068 bytes
First seen:2020-08-04 14:41:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:HV45GT1af/4Esa2nGioksvHsNdMBWr9HTbXlpeR5ThN1wcYD3wsN9iog:HWQx77nGasvHeuBUZTbX2R5D1wlDAehg
TLSH CBF423DC206973A0B907A7BC3036F6A2BCD54F232517B247B65037191FD677A2298CE6
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.vreo.net
Sending IP: 143.95.90.162
From: Steve Kiko <steve.kiko@parker.com>
Reply-To: engineering@engineer.com
Subject: RFQ
Attachment: Parker Hannifin Corporation.zip (contains "Parker Hannifin Corporation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.21549.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69fe13f4286f7e67ea6c10fc852f9afa4065271577190f6523536a3947dac82d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 14:43:05 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nh7bh5bin57gp2tmcd6ikl427jagkjyvo4mq6zjdknvdsr62zawq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/69fe13f4286f7e67ea6c10fc852f9afa4065271577190f6523536a3947dac82d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 69fe13f4286f7e67ea6c10fc852f9afa4065271577190f6523536a3947dac82d

(this sample)

FormBook

Executable exe 22d5036d18a7dbaf7a67487165b4bca434220d5d066ba9f74bc1ad20eb37290a

  
Dropping
MD5 823090de7407350d22f8ce47ac312cf0
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22d5036d18a7dbaf7a67487165b4bca434220d5d066ba9f74bc1ad20eb37290a

Comments