MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c06bc0e11c55f2d605c0c1556643ed7afc706a9d3f0b6ca385c030ee7a65b407. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c06bc0e11c55f2d605c0c1556643ed7afc706a9d3f0b6ca385c030ee7a65b407
SHA3-384 hash: ea01ea031897b1c79eac0aff4ffdc711ccbcd10f98f55c614db92fd0be838cc03bbd485cbf7e676143eb49a143ed3e39
SHA1 hash: 3987f2f0208fa294280afdd8d465f64d3eae05b1
MD5 hash: 510bc347660057b9cf5ce653df578047
humanhash: uniform-twenty-magnesium-earth
File name:PLPI.img
Download: download sample
Signature Formbook
Create hunting rule
File size:827'392 bytes
First seen:2020-10-22 07:06:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:/SrGstOPj+rCVhOKAHjAvAqxB9I4xprukIROZYIyTDL4/sY1YzERcTbjP2S5oAPd:/SZkjI+8XL4/FmL3QjnTI
TLSH 10057CBC325072EFC867D4729AA82D64AB63747B831B4203902715AD9E7DB97CF144F2
Reporter abuse_ch
Tags:FormBook img SendGrid


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: o1678912x138.outbound-mail.sendgrid.net
Sending IP: 167.89.12.138
From: Carol Fan <mizoudiba1@maymovo.com>
Subject: RE:RE: PURCHASE ORDER:DKSB ADM (P) 100-2020 (SMARTFAC
Attachment: PLPI.img (contains "PLPI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c06bc0e11c55f2d605c0c1556643ed7afc706a9d3f0b6ca385c030ee7a65b407/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 06:09:41 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ybv4byi4kxznmboayfkwmq7npl6ha2u5h4fwzi4fyayo46tfwqdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img c06bc0e11c55f2d605c0c1556643ed7afc706a9d3f0b6ca385c030ee7a65b407

(this sample)

Formbook

Executable exe 2abd32fd6ec97ad3fa0d675153247b7449025f7087a7dfdee569143f195d2cf5

  
Dropping
MD5 61233f0d65b9fdcc4e4ffe7f8305b36e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2abd32fd6ec97ad3fa0d675153247b7449025f7087a7dfdee569143f195d2cf5

Comments