MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9eaa0b02d32d3f246cd87a86c0b27a51fb510a9c7e9d67740c4bede864c2e7c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9eaa0b02d32d3f246cd87a86c0b27a51fb510a9c7e9d67740c4bede864c2e7c3
SHA3-384 hash: e3f87fcd04936a211a30bd9419b3cbd88f3e8f8797c509497fad6f2239991bf97827a675f5467edc0c4e3eaec8619000
SHA1 hash: aa733c5f8caed9c71e797fc916d05ac67649cef4
MD5 hash: 31dd953b6e14c3888023120361a7cdcd
humanhash: table-bakerloo-social-saturn
File name:PaymentAdvice.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:253'130 bytes
First seen:2021-04-08 07:04:22 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:HI82hwIVv+9VK7ynU7VVjnbxplPEL59bq1nv9rH25JQ:Hn7IlAKWcjnTlPEL/qnvZHOQ
TLSH 583423CB774DF99B9570E0384E2A53E50B46B8B18B4BCF8B42D13E5AE3246CF74A5184
Reporter abuse_ch
Tags:cab


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.barssan.com
Sending IP: 45.133.1.176
From: Account Payable <payable@vf1c.com>
Subject: Payment Advice 07_04-21
Attachment: PaymentAdvice.cab (contains "PaymentAdvice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.4151.19347.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9eaa0b02d32d3f246cd87a86c0b27a51fb510a9c7e9d67740c4bede864c2e7c3/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 05:42:37 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t2vawawtfu7si3gypkdmbmt2kh5vccu4p2owo5amjpw6qzgc47bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/9eaa0b02d32d3f246cd87a86c0b27a51fb510a9c7e9d67740c4bede864c2e7c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 9eaa0b02d32d3f246cd87a86c0b27a51fb510a9c7e9d67740c4bede864c2e7c3

(this sample)

Formbook

Executable exe f45a023c86d834183f3073c05227d6f40686aef4a71b3893b823be493d7aae83

  
Dropping
MD5 6f7b859f349e73f24ddffa5bf11bbe27
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f45a023c86d834183f3073c05227d6f40686aef4a71b3893b823be493d7aae83

Comments