MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9cc7a7ce1f5bd112c3a87dc0c6e28b4b1ae5813795bf1ab1ab00954a422da08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9cc7a7ce1f5bd112c3a87dc0c6e28b4b1ae5813795bf1ab1ab00954a422da08
SHA3-384 hash: 29502589811a299f22decaa358879a675883f88ab39720c3ded07200920248cdb38b4da74ddec72a7a507015aed02d44
SHA1 hash: 2652d6541a1e1561340e35e278109808e5e1565c
MD5 hash: 44e5d753c4693cfa1ddf11a233b8b46f
humanhash: snake-princess-connecticut-oklahoma
File name:Quote RF-E79-STD-2021-083 Health Safety Items_pdf.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:484'495 bytes
First seen:2021-01-18 08:29:09 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:SHu9eGu3A5bqISJyWzYWaJKdHtGTmk8vbhSP/:SHu9jpqISJyGplsmvbhk
TLSH F7A423F7534572CCA1C48E2D5B4740ADEEF622ECDA0F4C77468AB210F5462A4EE94D3A
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sivdovps100-1.hachete.com
Sending IP: 84.124.52.26
From: NEXUS SHIPPING CO.,LTD <nexus@nexusship.com>
Reply-To: nexus@nexuship.com
Subject: Request for Quote RF-E79-STD-083
Attachment: Quote RF-E79-STD-2021-083 Health Safety Items_pdf.arj (contains "Quote RF-E79-STD-2021-083 Health Safety Items_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9cc7a7ce1f5bd112c3a87dc0c6e28b4b1ae5813795bf1ab1ab00954a422da08/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-18 08:16:01 UTC
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xhghu7hb6w6rclb2q7oay3riwsy24watpfn7dky2waevjjbc3iea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b9cc7a7ce1f5bd112c3a87dc0c6e28b4b1ae5813795bf1ab1ab00954a422da08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj b9cc7a7ce1f5bd112c3a87dc0c6e28b4b1ae5813795bf1ab1ab00954a422da08

(this sample)

Formbook

Executable exe 98be979a6ee314a1829acd3d33744d9caf8fe2c871d6b73d3771c76c09584387

  
Dropping
MD5 3b55b80721a7de879aa7f6cbdbfeb77d
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98be979a6ee314a1829acd3d33744d9caf8fe2c871d6b73d3771c76c09584387

Comments