MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c
SHA3-384 hash: 6eacc06494be43e843cd322bc55850f43e3953b7388e9f45b76760d1a212e956e8689c008e852ee4d5fdecbaf8294945
SHA1 hash: 82bc62dc54ef61b3f95163832d05f4a62bb1e627
MD5 hash: 434397be5732a503e4a7d058e9a55253
humanhash: double-mobile-muppet-vegan
File name:Quotation DG-H2091717 Order.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:455'878 bytes
First seen:2020-08-17 13:53:08 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:QNawXTSdkJ7XFSBL3uKN5kC068BB5Lz8+r0xbG9Rfid:QIwjSdkJ7XkBx0fBB5Lzr0xyi
TLSH 09A423A6AC3B4D3A6878679593228DB1D868B1B17E5003B057D6F40EBD138F84D4DF4E
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: ns5.bilsay.com
Sending IP: 89.252.181.244
From: <arma@armaltd.com>
Subject: Quote Price & Availability // UR CONTACT US
Attachment: Quotation DG-H2091717 Order.r00 (contains "Quotation DG-H2091717 Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 13:55:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4jvpwktrxk4r4pzn3bmi3ifesq3kdme4jdgmwyi4a2qo3fxyl6ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 e26afb2a71bab91e3f2dd8588da0a49436a1b09c48cccb611c06a0ed96f85f8c

(this sample)

Formbook

Executable exe 510b24a8ddcc1a99925f07d8ec0b56489930147a95810b787291b3396bd54a7c

  
Dropping
MD5 281adb9d80c76b1d55dd373ea0c9d76a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 510b24a8ddcc1a99925f07d8ec0b56489930147a95810b787291b3396bd54a7c

Comments