MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da
SHA3-384 hash: d838b1ef71e452effdafbe01cedee5b58cfab44dff093ce3e8e122a98cd7cd551a6ee641c27c5e66af181e216d6f7f63
SHA1 hash: 850852433efda230a4b72d1faac7c0e90d96874d
MD5 hash: c1284b4bff017bb4407e2cd12769fb01
humanhash: freddie-cola-freddie-texas
File name:Proformainvoice.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-12 14:36:16 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:e1EFE2e2akCgK/z03+l03+2LweWxLf3rnUniDbGSZY3l6/4jiT:FFE2qkgz03+l03+2LLWxjbtmxVq4W
TLSH 5C45C02473A59863E13A3E35CAB71514077BBC973539C70E6ADE33CE99303E949107AA
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Hellandshamn <forbrukerkontakt@gjendemsjo.no>
Reply-To: forbrukerkontakt@gjendemsjo.no
Subject: FACTURA PROFORMA
Attachment: Proformainvoice.img (contains "0mwSprBZ47mNQyY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.RSharedStrings.7859.8616.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 14:38:06 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q27pvgjjfaqtjcw3lopeauulevbeolmuka2iwhdb5pye3wucndna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 86befa99292821348adb5b9e40528b2542472d9450348b1c61ebf04dda8268da

(this sample)

FormBook

Executable exe ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827

  
Dropping
MD5 0ad8631c3de13ef3867d5d887b6d2faa
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea74eac48adf2b19c3102578cb14ee0cd1d51f5e5e1da2fb4ab5b0d3f7e91827

Comments