MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 824d75b5f9666031d5fd93ddfe32115778b56cf60f2034b438493de2f82edef9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 824d75b5f9666031d5fd93ddfe32115778b56cf60f2034b438493de2f82edef9
SHA3-384 hash: 7e2c6637654c116ab110b96db2f2431e23c3ea6b77485610158cfbadd0a5405efffc241f1c78fc29ff423e40e9d01391
SHA1 hash: 6dd2e99e32849db20ca633be96222770f9795f08
MD5 hash: 56db558b52980242815f12f639f0482f
humanhash: september-vermont-wisconsin-hotel
File name:TEB38204.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:412'250 bytes
First seen:2020-08-06 06:33:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:fpBkxV/ZS4ZuXX39eI6MST+wNrDqMKLVKg6gPlJ:IxVxS4Sn9eI6xvDFfgv
TLSH 4494230B7F9AB0417EF603D297401BCF895833889E3DC76B93A499ECCC52BC90B65664
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic310-25.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.186.206
From: Jenny Asrad <chisomnwaezigbo@yahoo.com>
Reply-To: Jenny Asrad <jennyasrad0016@gmail.com>
Subject: Fw: Inquiry
Attachment: TEB38204.rar (contains "TEB38204.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/824d75b5f9666031d5fd93ddfe32115778b56cf60f2034b438493de2f82edef9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:34:08 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjgxlnpzmzqddvp5spo74mqrk54lk3hwb4qdjnbyje66f6bo334q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/824d75b5f9666031d5fd93ddfe32115778b56cf60f2034b438493de2f82edef9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 824d75b5f9666031d5fd93ddfe32115778b56cf60f2034b438493de2f82edef9

(this sample)

FormBook

Executable exe d2c40a6c3a34fadef89837273bd4ac6eb9d964a3093852293961f263a077ee5c

  
Dropping
MD5 1b89b3a63b28a0edb5ff2cc6e7110b84
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2c40a6c3a34fadef89837273bd4ac6eb9d964a3093852293961f263a077ee5c

Comments