MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8d642c0149c9f660b45974b5dc2e6092a645aa74756c5a6afcb1fa3d8075607. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8d642c0149c9f660b45974b5dc2e6092a645aa74756c5a6afcb1fa3d8075607
SHA3-384 hash: 92cb0158b72fd1ccaad7a65d9fde9cd50045ad8045ea43b90e7f84b315b96347df3c89687d031baf4c9221b70bb91eb0
SHA1 hash: 175cdda11bfef8c23e0e1d1cc0e615815e78316e
MD5 hash: e654ee17f609cf6216a6e945efa67a70
humanhash: texas-twelve-september-green
File name:ORDER_LIST.LZH
Download: download sample
Signature Formbook
Create hunting rule
File size:825'816 bytes
First seen:2021-01-19 07:31:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:FWUB4338T/m4mpWi0kWOE4dii44dZI7PJTL:FxB4H8S4KB0kJZTMjJTL
TLSH 130533D63C787254B97E46F4A97D3D8CF359AEDB210E850682B60C6F07230B6568393E
Reporter abuse_ch
Tags:FormBook lzh


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: smtp2.hiworks.co.kr
Sending IP: 121.254.168.210
From: 조재민 <newiz8@dsmecasys.com>
Reply-To: "조재민" <newiz8@dsmecasys.com>
Subject: ORDER_JANUARY
Attachment: ORDER_LIST.LZH (contains "ORDER_LIST.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f8d642c0149c9f660b45974b5dc2e6092a645aa74756c5a6afcb1fa3d8075607/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:32:18 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7dlefqautspwmc2fs5fv3qxgbevgiwvhi5lmljvpzmp2hwahkydq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f8d642c0149c9f660b45974b5dc2e6092a645aa74756c5a6afcb1fa3d8075607

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar f8d642c0149c9f660b45974b5dc2e6092a645aa74756c5a6afcb1fa3d8075607

(this sample)

Formbook

Executable exe 3a04294c74c076d017ac8f59b506f735547d31472f7480cb6652dea5e3a2816c

  
Dropping
MD5 fa181a9414347d63137af021b2141cd6
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a04294c74c076d017ac8f59b506f735547d31472f7480cb6652dea5e3a2816c

Comments