MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c59a5a841e54ba20962e87fde48bed3efdd81b051e27e3ed26b22683c68371. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2c59a5a841e54ba20962e87fde48bed3efdd81b051e27e3ed26b22683c68371
SHA3-384 hash: 3e311a62607d2df19cea434548ff9ea8cbfb2a7e00937d43586a36563b5034dc625350340b6683b7e6d004e40580f3e8
SHA1 hash: 62a3d74ce14cc12db88d4d5235826627b161906e
MD5 hash: db525aa1369703329e308152df98e44d
humanhash: princess-hydrogen-three-uranus
File name:payment document.uue
Download: download sample
Signature Formbook
Create hunting rule
File size:31'421 bytes
First seen:2020-12-10 11:10:34 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:zbLE9WA6XZY7Y1a7OfqS0VXUcXbd3ioZC4vnLq3zmhh:fLZA6m7Y87OtcLlBjvLqah
TLSH F2E2F1FF17B21C6B1C89F15CDA39336128AB22952303AD6CB5D26EFD52F81129BE0D41
Reporter abuse_ch
Tags:FormBook uue


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.mailerhost.net
Sending IP: 188.227.107.156
From: Marco Borsboom <info@temmotor.com>
Subject: Top Urgent-Please Confirm Account Number
Attachment: payment document.uue (contains "payment document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
214
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn5.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2c59a5a841e54ba20962e87fde48bed3efdd81b051e27e3ed26b22683c68371/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-12-10 11:11:07 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylczuwuedzkluiewf2d73zel5u7p3wa3aupcpy7ne2zcna6gqnyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c2c59a5a841e54ba20962e87fde48bed3efdd81b051e27e3ed26b22683c68371

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c2c59a5a841e54ba20962e87fde48bed3efdd81b051e27e3ed26b22683c68371

(this sample)

Formbook

Executable exe 448d2ecff6d2b8cf7a5da39c4be57e4bb991fcf35a1a6bfbe24f0430684fc59c

  
Dropping
MD5 50f9cf33552796c0935796d448df1ca3
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 448d2ecff6d2b8cf7a5da39c4be57e4bb991fcf35a1a6bfbe24f0430684fc59c

Comments