MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c638e261e0e87891f22699385fba646ff112f6ccd912e4b459aa664ff4faf704. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c638e261e0e87891f22699385fba646ff112f6ccd912e4b459aa664ff4faf704
SHA3-384 hash: 75a47986a4ffc227da3752cdea8bcbbfdde175b5c15c52211137f0e5f2f133e0aaccff4be8d21cd1c090292f01a0d393
SHA1 hash: 345a31f30cc81908ff752372e26af9fe01452c6c
MD5 hash: 6c5bd51a558f9e829604e4cd7a574cda
humanhash: nineteen-nine-fanta-coffee
File name:SEA LION LOGISTICS-URGENT QUOTATION_ PDF.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:417'850 bytes
First seen:2021-01-11 09:14:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:a5cUvy1/twlGoyqm24RyK0RRQQYCJhB1/966qRU3GpaRjD1YEy/G7we6Top:aZv0/2wp53GdB1F6zRyEE1/y/uB6Tg
TLSH 9A942367608A0C25C73AD3EC94CF637A4840A79825F58BA97F3D1F58506B3A9846EC1F
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.richermoren.gq
Sending IP: 5.8.93.39
From: Mr. Dave <kizit@richermoren.gq>
Subject: FW: RFQ: QUOTATION REQUEST
Attachment: SEA LION LOGISTICS-URGENT QUOTATION_ PDF.r00 (contains "SEA LION LOGISTICS-URGENT QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c638e261e0e87891f22699385fba646ff112f6ccd912e4b459aa664ff4faf704/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 09:15:07 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yy4oeypa5b4jd4rgte4f7oten7yrf5wm3ejojnczvjte75h264ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c638e261e0e87891f22699385fba646ff112f6ccd912e4b459aa664ff4faf704

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c638e261e0e87891f22699385fba646ff112f6ccd912e4b459aa664ff4faf704

(this sample)

Formbook

Executable exe 6c595ae0af40886a5d0e907120894e72fadef005a527230b5c28a3e2767789f1

  
Dropping
MD5 cbde8f396859b03c0b93cd90f91f9871
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c595ae0af40886a5d0e907120894e72fadef005a527230b5c28a3e2767789f1

Comments