MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da0cfb1c3b7dd849a4a0d27784c0276672362b379e5d21924d653a605e201c47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da0cfb1c3b7dd849a4a0d27784c0276672362b379e5d21924d653a605e201c47
SHA3-384 hash: 7666bc10d11e28da1f9861d7edfecad9612dfbced5aa23a92c09ce8315e1ec4a5727671f57eba9f0268cc08a107caec7
SHA1 hash: 78bee62feebb526cb9e6b179612dc18366da0abf
MD5 hash: a9e442cdd744f898231117cafcee6425
humanhash: undress-one-cola-grey
File name:Neft_pdf.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:383'482 bytes
First seen:2020-06-12 12:00:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:8cR2FchQeUmH1B+gzk0NDGpiSHOsk/GL/+B6w9zH66XeXHucZxvHINxs:8xFchQeUmH1Bbk0NrhIL0z1XcO2H0u
TLSH A684239D2FAFAB11A1BA1B083F71CED5087307BD20C56CBE856E1E153A485C449EE6C7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.wewinning.xyz
Sending IP: 45.95.169.89
From: neft@idbi.com
Subject: NEFT Credit Confirmation
Attachment: Neft_pdf.zip (contains "Neft_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 12:02:08 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3igpwhb3pxmetjfa2j3yjqbhmzzdmkzxtzosdesnmu5gaxradrdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip da0cfb1c3b7dd849a4a0d27784c0276672362b379e5d21924d653a605e201c47

(this sample)

Formbook

Executable exe d55d8f3161c37cc5247393735e1551fd1adeaf579a4fdae037b07d2be5a2d2fb

  
Dropping
MD5 1c73b6d7de9fbf981efbb92ac81770ca
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d55d8f3161c37cc5247393735e1551fd1adeaf579a4fdae037b07d2be5a2d2fb

Comments