MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c89de85ebb2cbff52e01fcb9647d7b53b945b01647e094e0ed561612b2c5818. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c89de85ebb2cbff52e01fcb9647d7b53b945b01647e094e0ed561612b2c5818
SHA3-384 hash: 91deebd6db4d27634cec787df90bf51dc1bdfd9affdf5272a2a89485c1b617377322706ebd8b1424cba1e4e2ff8019f4
SHA1 hash: 5e42d4c7645dccd8f7fcb1c8c094541afe7913f8
MD5 hash: cf00c64283324f61041845ede6471526
humanhash: seventeen-stream-oscar-nineteen
File name:Draft FCRHBL.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:624'675 bytes
First seen:2021-01-15 07:09:49 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:hVIFRzPfAjUWb935Mm33HqEGd7vvo1VuCyPWnAh:UFRnWbZ5Mm3Id7vvcVyPjh
TLSH 29D423B00486E60DFA4461D2E66362F63ECB35C92E9C99F1B54D77F1316C0CE5C6A28E
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: v238095.serveradd.com
Sending IP: 101.100.238.95
From: SealandMaersk Support Team <daniel.joseph.lin.yu@lns.maersk.com>
Subject: Draft FCR _ GREATGL_USFEDMERCH _ Draft FCR# 5 FCRs/HBLs VNGREATGL_USFEDMERCH
Attachment: Draft FCRHBL.arj (contains "Draft FCR-HBL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
149
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c89de85ebb2cbff52e01fcb9647d7b53b945b01647e094e0ed561612b2c5818/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-15 07:10:07 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pse55bplwlf76uxad7fzmr6xwu5ziwybmr7astqo2vqwckzmlama._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7c89de85ebb2cbff52e01fcb9647d7b53b945b01647e094e0ed561612b2c5818

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 7c89de85ebb2cbff52e01fcb9647d7b53b945b01647e094e0ed561612b2c5818

(this sample)

Formbook

Executable exe 5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b

  
Dropping
MD5 cca5f563da874fee695fd34f35d9692a
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5cd75052c82b5ff0cc1261075c4fdb060c21062c72525508cbb75e44683f6d0b

Comments