MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfa136640e21a3950801e0eae4edead1f9c0139abdf946ebe4a2df5b53a6892f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfa136640e21a3950801e0eae4edead1f9c0139abdf946ebe4a2df5b53a6892f
SHA3-384 hash: 75084a84e207521f938bef0efa24ac304726e21b1c3ed9b352db6130342cfd499ea8f1a80d861495143686641072b89e
SHA1 hash: b217328aa9dc5bfd8f9725562a7248ad2460f0f1
MD5 hash: 05fe56f3c66d1cd5b7ef823e21b45e1d
humanhash: charlie-delaware-happy-monkey
File name:Louisbourgorderpdf.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-11 13:42:31 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:yiyLclauU58t+xL4XUhaz1ich0FkQv4pU1F3siNz7ltguqOUuTD7oAyRqxbBnS:yiSclvUKoxLfEh4/vZ1FjfHgu4uLyG
TLSH 8345EF4566801B46C53E97788321152503F2ED2BA738EB5A7FDB32EC0B73BB29791907
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Louisbourg Seafoods Ltd <damien.b@louisbourgseafoods.ca>
Reply-To: damien.b@louisbourgseafoods.ca
Subject: ORDER08112020
Attachment: Louisbourgorderpdf.img (contains "eDAwBRs0aYf2st9.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfa136640e21a3950801e0eae4edead1f9c0139abdf946ebe4a2df5b53a6892f/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 13:44:10 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6qtmzaoegrzkcab4dvoj3pk2h44ae42xx4un27eulpvwu5grexq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/cfa136640e21a3950801e0eae4edead1f9c0139abdf946ebe4a2df5b53a6892f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img cfa136640e21a3950801e0eae4edead1f9c0139abdf946ebe4a2df5b53a6892f

(this sample)

FormBook

Executable exe 2351032596ba226e2ae00a4967cd8f85b158b5b2cfc1869d919bf5a2eea3c129

  
Dropping
MD5 fcc5ff39318b32269efa3ba4814d694c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2351032596ba226e2ae00a4967cd8f85b158b5b2cfc1869d919bf5a2eea3c129

Comments