MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c93b899a9ed79d10e552fada99ddd1466976687fe491457a9ca53a0083c11ee8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c93b899a9ed79d10e552fada99ddd1466976687fe491457a9ca53a0083c11ee8
SHA3-384 hash: bd93c7fc93cea81facac61cb32f9731421c2892c93691ce7e3200035a405792911f79d2ab445e44e23c8ef3829a4c1bc
SHA1 hash: 5dd7e769e3c98af8b4d837ae04e8010d4210727a
MD5 hash: 999a28c462fdca7e0ea8738355debc33
humanhash: charlie-fillet-fanta-quiet
File name:Nov Order 17-08-20TNQ1.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:526'090 bytes
First seen:2020-11-18 12:55:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zyNnXPt9GH55ReRLNf5TsbxNDkCa+EhBvg4R8sJ0hhuBaFjIT:pHOxf5TMoB4DsJhBa+T
TLSH 22B4238F594122098820EC0B652EFCF8EDC2F5BC59FBD3D4E41EE185A55FA6B850690F
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.mammoth.local
Sending IP: 210.255.88.226
From: "Allen Wu" <nestley@tpg.com.au>
Subject: RE: 采凡- 詢價 124
Attachment: Nov Order 17-08-20TNQ1.zip (contains "ant.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c93b899a9ed79d10e552fada99ddd1466976687fe491457a9ca53a0083c11ee8/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-18 10:46:37 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ze5ytgu626orbzks7lnjtxorizuxm2d74siuk6u4uu5aba6bd3ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip c93b899a9ed79d10e552fada99ddd1466976687fe491457a9ca53a0083c11ee8

(this sample)

Formbook

Executable exe c2ed9a707bd10d4d9d9291d1fd7bc7316d8a80f846b6263c800ff89885641e37

  
Dropping
MD5 7c070cf385827c93cc9a077f5e4b0a21
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2ed9a707bd10d4d9d9291d1fd7bc7316d8a80f846b6263c800ff89885641e37

Comments