MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f178d34eb00544e0d03761e74f49fa6c8aa9a407076c0fe7cd2a02e9ccfaf34d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f178d34eb00544e0d03761e74f49fa6c8aa9a407076c0fe7cd2a02e9ccfaf34d
SHA3-384 hash: 6d9f6c389753ba957e8ca15be5c2c9ecd98e5aeb0d0585360b5e0b5dc0199bde3a3ce581a737888b522855fac3a8ee6c
SHA1 hash: eb1c1ab5936ab715c39bd8d9c748a199c7c5d137
MD5 hash: 0735406726d5eae3bbbd0a4b83377682
humanhash: angel-washington-alaska-mars
File name:quotes request.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:684'542 bytes
First seen:2020-08-04 16:47:55 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wpJPDQVn6d2gt1L8JvESheIQaPISdG+WaaRE2zBLx9m1f56LaVK0bCLNjEyYx:wHIvDFESVP5dGhEAB6cayLby
TLSH F8E423D5B0A63789CF24F25F1AF34A0BB8165CCA0854739BF016BC42D917A2DDA396CD
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

From: Paccagnini Marisa <marisa.pacagnini@pompetravaini.it>
Reply-To: Paccagnini Marisa <marisa.paccagnini@qualityservice.com>
Subject: AW: Quotation Request
Attachment: quotes request.zip (contains "quotes request.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Backdoor.MSIL.Bladabindi.4637.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f178d34eb00544e0d03761e74f49fa6c8aa9a407076c0fe7cd2a02e9ccfaf34d/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 16:49:06 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6f4ngtvqavcobubxmhtu6sp2nsfktjaha5wa7z6nfibotth26ngq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/f178d34eb00544e0d03761e74f49fa6c8aa9a407076c0fe7cd2a02e9ccfaf34d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip f178d34eb00544e0d03761e74f49fa6c8aa9a407076c0fe7cd2a02e9ccfaf34d

(this sample)

Formbook

Executable exe 6830866e2d41b970c95172f9a156522c72cfd238f846c02c19827b2100fc5deb

  
Dropping
MD5 ccab83b670a6d84be1f7e2b5c2f93fa7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6830866e2d41b970c95172f9a156522c72cfd238f846c02c19827b2100fc5deb

Comments