MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2
SHA3-384 hash: 36d32b739539ac608ba240b5fa76bb08efd58625ebc48ac283745969dfa3c68a55d4d27c3b12fa00237878f91e926dc6
SHA1 hash: dbf268e40317152da700883a262177bcb01baaf8
MD5 hash: 3b6a8874906784a400c8992e37edbcfc
humanhash: quebec-table-two-east
File name:TSPO0001978-xlxs.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:217'413 bytes
First seen:2021-03-30 07:37:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:xGOV2Z4P1JPFrE1LdSuN2ovUg3yyKu0n7RKATjs6U:xLV2ZsPJE1LdSETvUA5t01Ljs6U
TLSH 3C241241F6CC24BDC466C8F30F51D9B32CEDBAEA3153145112A3A5ADE626EDBCE434A4
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Generic-S.6165.5196.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 05:05:16 UTC
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66fv4z4ow3xsoylqn2h2c67pdxl5mxr5g7kfimm6saacvsyyhxza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip f78b5e678eb6ef2761706e8fa17bef1dd7d65e3d37d454319e90002acb183df2

(this sample)

Formbook

Executable exe 8d96cdba8c8ac7896773c03f0ab27a5cebe912d9cc6614fda1e149191fc6a7c7

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8d96cdba8c8ac7896773c03f0ab27a5cebe912d9cc6614fda1e149191fc6a7c7
  
Dropping
MD5 692bd89d8f8c658c6e2082c86e47dc2b

Comments