MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb57eebe68be1336c37fa799c141902545e4b571a9b18bb8f77ddac05cad7056. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb57eebe68be1336c37fa799c141902545e4b571a9b18bb8f77ddac05cad7056
SHA3-384 hash: 1ab4eadc8392617f042f7524713d30bc2ebe26989a2eb77561f48053f866389ffece2e0ab20c9272b9424fa4e0023d7b
SHA1 hash: 09342def762ef467ead7b77085806d8fd9034d5d
MD5 hash: fc094a79922506d895a6e7592961a0c7
humanhash: enemy-quiet-foxtrot-five
File name:account confirmation!.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:721'674 bytes
First seen:2020-11-23 06:30:41 UTC
Last seen:2020-11-23 06:32:29 UTC
File type: z
MIME type:application/x-rar
ssdeep 12288:ikun65TEHuk2OiQ4LyrI7muyVSk4BUj1WtKzTBmtNW/Bt8TUxB7SI4hha:uwAHfZVI7aVS+jIycNWnKUx9kk
TLSH 30E4230AEA3688FE9DA2825DD1DF9D387F7920FEE1C03E254F158246225475CB1F81B9
Reporter cocaman
Tags:z


Avatar
cocaman
Malicious email (T1566.001)
From: "ACCOUNT<info@meherinternational.in>" (likely spoofed)
Received: "from meherinternational.in (unknown [92.118.190.190]) "
Date: "23 Nov 2020 01:53:24 +0100"
Subject: "Fwd: Urgent Attention: Payment Reconfirmation -EIM PAYMENTS"
Attachment: "account confirmation!.Z"

Intelligence

File Origin
# of uploads :
2
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb57eebe68be1336c37fa799c141902545e4b571a9b18bb8f77ddac05cad7056/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-22 23:30:28 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=znl65ptixyjtnq37u6m4cqmqevc6jnlrvgyyxohxpxnmaxfnobla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb57eebe68be1336c37fa799c141902545e4b571a9b18bb8f77ddac05cad7056

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z cb57eebe68be1336c37fa799c141902545e4b571a9b18bb8f77ddac05cad7056

(this sample)

Formbook

Executable exe e84b45b4e30dbdd8025a76075af204369ea5b1c638b7c15ec7998600936ce181

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e84b45b4e30dbdd8025a76075af204369ea5b1c638b7c15ec7998600936ce181

Comments