MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a469b8c1c4d984f839fe97edcf76742707d1d1d564badc630bd04beee40fc509. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a469b8c1c4d984f839fe97edcf76742707d1d1d564badc630bd04beee40fc509
SHA3-384 hash: 09f632bc3aea062191354b244bf38958d41c72ae2577ab6f1bd86e57481165e7b6ebbf4fd4b234dba590b6d6eb472edb
SHA1 hash: 29193b2e0706af4a979707ac2a19057b8bd22e60
MD5 hash: f3604ca6e55b653da2a1580721d48236
humanhash: stream-grey-princess-happy
File name:HKT431686546373A.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:399'568 bytes
First seen:2020-10-23 11:36:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PWZO05I9/0n42zzGJF109JjB87ctEgqnN5qGek1cxX3EuQxKm:PWeM42zIsJiK2N5qHk1cxX0uQxR
TLSH 84842386ADF319C493CA0D685E6C13DFD33F46828594D492F92A8D93B604DF2E98FB10
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: bjcs01.serverproof.net
Sending IP: 180.76.192.144
From: infofh@fhtextile.com
Subject: Re: Purchase Order
Attachment: HKT431686546373A.rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a469b8c1c4d984f839fe97edcf76742707d1d1d564badc630bd04beee40fc509/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 11:04:23 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uru3rqoe3gcpqop6s7w465tue4d5duovms5nyyyl2bf65zapyueq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a469b8c1c4d984f839fe97edcf76742707d1d1d564badc630bd04beee40fc509

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a469b8c1c4d984f839fe97edcf76742707d1d1d564badc630bd04beee40fc509

(this sample)

Formbook

Executable exe 74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf

  
Dropping
MD5 65ca30c93b36264e87d85d09bf7b34a7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 74ee80ac61ce369a23feac3296a825873aa257282d5dd0f9c35c385e3d6766cf

Comments