MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2dba9e0ab16221eae59bf2379a99c5ec508c95c9eac922e979e86f5962b2e1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2dba9e0ab16221eae59bf2379a99c5ec508c95c9eac922e979e86f5962b2e1b
SHA3-384 hash: fa181be56a61e649760d6fc46f1223cde036be1b16bc0caa1d81107b0fc68f04ce20acdf310767a5d17ec759d35ded15
SHA1 hash: 6335df3fc9a214cfb8109ca5aa015c45545cb8bd
MD5 hash: 6455f0849ff2b29740fe7173aff15c4a
humanhash: washington-lima-summer-west
File name:Quotation Request.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:408'682 bytes
First seen:2021-03-06 13:43:36 UTC
Last seen:2021-03-10 00:23:36 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:oZ3GDgCM/NoM+HTwT87gMOoJqB4vLtOpwcMv89bQWgpR/hKOyodPOERgF7dDV:6GzVTwT8UC0B40wElQppR0QRgF1V
TLSH A09423A2DD7271A476456CD3876348FF3D1E8CA6CEE4AE08789C98612D770333D2516B
Reporter cocaman
Tags:FormBook zip

Intelligence

File Origin
# of uploads :
7
# of downloads :
344
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs2022.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e2dba9e0ab16221eae59bf2379a99c5ec508c95c9eac922e979e86f5962b2e1b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-06 11:38:46 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
6 of 45 (13.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ln2tyflcyrb5lszx4rxtkm4l3cqrsk4t2wjeluxt2dplfrlfynq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/e2dba9e0ab16221eae59bf2379a99c5ec508c95c9eac922e979e86f5962b2e1b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip e2dba9e0ab16221eae59bf2379a99c5ec508c95c9eac922e979e86f5962b2e1b

(this sample)

Formbook

Executable exe b7d74de8e9514ca3fbfa4676be4433069bc913f86953a79d40c6272d5077242c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7d74de8e9514ca3fbfa4676be4433069bc913f86953a79d40c6272d5077242c
  
Dropping
Formbook

Comments