MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8935bcfd637972593b604274d8640093bc772b0a4052bb7dd06acc33bf611e8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8935bcfd637972593b604274d8640093bc772b0a4052bb7dd06acc33bf611e8b
SHA3-384 hash: 8051d89977f04a6849c97934f35273f7b329f25dcb57743ab777e81f4964ccca27283893920f5ae3dcae7a31b3cc7e8a
SHA1 hash: 2063874aff0d486daf20ea7f84c4993f13c930f2
MD5 hash: 17d64d7b8788baec40c8c6fde260d8ec
humanhash: social-fanta-emma-autumn
File name:Top urgent Final RFQ by Chloe.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:597'476 bytes
First seen:2020-10-28 07:48:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8oDboDLChWBnZ0re2xUuXouhIbFafVjAkjJ9IGKqV6k/P+LfF9BiN+yzAE3UBrO:8oDstkrDxUuXRIbwVjrJqGAwPwN9MvA2
TLSH 47D423E1A7F9781C6B96C83B2293637C1A1359CD38AE63B30456C552EB15C8F441B7D3
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dlveltex.co
Sending IP: 111.90.140.219
From: Chloe <sales@bd-valve.com>
Reply-To: mara@dststrade.com
Subject: RE:Top urgent Final RFQ Required - Important.
Attachment: Top urgent Final RFQ by Chloe.rar (contains "Top urgent Final RFQ by Chloe.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8935bcfd637972593b604274d8640093bc772b0a4052bb7dd06acc33bf611e8b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-28 05:29:12 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=re23z7ldpfzfso3aij2nqzaaso6hokykibjlw7oqnlgdhp3bd2fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8935bcfd637972593b604274d8640093bc772b0a4052bb7dd06acc33bf611e8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 8935bcfd637972593b604274d8640093bc772b0a4052bb7dd06acc33bf611e8b

(this sample)

Formbook

Executable exe 5038f7f49d3052a244db8019146b11b139d09d867205416ee70df3d97f065a28

  
Dropping
MD5 a966f314beef0fe8338f9f0b42b08650
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5038f7f49d3052a244db8019146b11b139d09d867205416ee70df3d97f065a28

Comments