MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f33ce427c9f06d136e5d57206dc4ff244219ab6cd10304a84ef6abc22078fe14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f33ce427c9f06d136e5d57206dc4ff244219ab6cd10304a84ef6abc22078fe14
SHA3-384 hash: b41c11ca78e998ba9db7a2c1ef42028b0dc3695d13fb2d89515a699a14f1c69deaaf94e9baeee55d52822cb26ad8dcfc
SHA1 hash: 7a90fca5b6cc578b78e58d10e4c74c0f0e07fec9
MD5 hash: d586d25e4affda3039b628b6c338ff59
humanhash: football-early-twelve-india
File name:SOA.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:431'617 bytes
First seen:2020-10-18 10:51:13 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:GyLKDInwQApmwQHeXsbiyA9jEc53ZnIdInAdmc3EdhK:P/nwPw1niyhc+mcso
TLSH 8D9423DDDEFA4A1379272DBD1B23BF659CDA8828CFF9C1A3817462B8235CC4C9459402
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: uzlinshpl01.uzcloud.uz
Sending IP: 185.74.4.8
From: designer@sawaindustry.ae
Subject: New Order//Statement Of Account
Attachment: SOA.gz (contains "SOA.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
132
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f33ce427c9f06d136e5d57206dc4ff244219ab6cd10304a84ef6abc22078fe14/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 07:27:08 UTC
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6m6oij6j6bwrg3s5k4qg3rh7erbbtk3m2ebqjkco62v4eidy7yka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f33ce427c9f06d136e5d57206dc4ff244219ab6cd10304a84ef6abc22078fe14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz f33ce427c9f06d136e5d57206dc4ff244219ab6cd10304a84ef6abc22078fe14

(this sample)

Formbook

Executable exe 8df5752017d7f083ddad62b8423ea7109c830dbcdca3fff0ee7aee8d149fdeda

  
Dropping
MD5 1c4d48a7663633e0cf2f80d11dc3c715
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8df5752017d7f083ddad62b8423ea7109c830dbcdca3fff0ee7aee8d149fdeda

Comments