MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7d33a4450d8e16937e3d16702028c27bb41496226afc43c426269e7251d4c4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7d33a4450d8e16937e3d16702028c27bb41496226afc43c426269e7251d4c4b
SHA3-384 hash: 73122aab98373c67e9f6ac112b7db0be41b7577e2f0efce6aba1ca8df2d5d3349bd9b258ad00ce7b70e37738cbde3856
SHA1 hash: b1faebf569fa3b1e4f323072bd6251f33c511cd0
MD5 hash: a660ba1847bdcc0515ba4ede52e5901a
humanhash: florida-sixteen-nuts-monkey
File name:HP_Scan21.10.20.scr.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-21 08:54:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:L+iri2d2mjMap3Bp1nQu4EonieFN2Mk+2vp51/wdzoGygQgJ+m4M4:jri8ukP1nQOonvwt7psygv
TLSH 644501987FC479DEC8D7C4368E982C78AB6074FB436B8663710F11AD9B4C897CE245A1
Reporter abuse_ch
Tags:DEU DeutscheBank FormBook geo img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: rdns0.pesaaf.xyz
Sending IP: 138.68.238.17
From: Deutsche Kredit Bank <Commercial@deutsche-bank.de>
Reply-To: commercial.rlavel@gmail.com
Subject: Zahlungsaviso
Attachment: HP_Scan21.10.20.scr.img (contains "HP_Scan21.10.20.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.30020.22058.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7d33a4450d8e16937e3d16702028c27bb41496226afc43c426269e7251d4c4b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 06:52:36 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=47jturcq3dqwsn7d2ftqeaume65ucslce2x4ipccmju6oji5jrfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img e7d33a4450d8e16937e3d16702028c27bb41496226afc43c426269e7251d4c4b

(this sample)

Formbook

Executable exe 15a8b67526b6b563f7fd48850bc4d5fb10e504bb9b2b156c9ce1d82a8a7aaaa7

  
Dropping
MD5 ba2ad8e5ad780bd8024ffadc7f2d76e9
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15a8b67526b6b563f7fd48850bc4d5fb10e504bb9b2b156c9ce1d82a8a7aaaa7

Comments