MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550
SHA3-384 hash: 4a88cad0395f38d82f71d70cb3ac4e30713ae1d4f1c06a9cc3b46b235881180ecaa93fede587d58a521636efe13761f7
SHA1 hash: e38ac63f3ae89e58a74c1d4e8af6758ab6cefcb5
MD5 hash: 5051bf8f1eff0bf5d24f64272193b3ea
humanhash: three-october-oven-jig
File name:invoice.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:622'591 bytes
First seen:2021-04-08 09:47:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:WH5Y6YKjwMGAT+X+EIvCTD5V53qpQ9q3dxhmdQe8fJVM0P9Y3hsT8j/VdnLzQOBl:Y5KiGAKX+TCfTApVDecGs2VdnLhqaD
TLSH 32D4339E740BC23C1ADBE163DEB34B845A8297F27829C6E14E75AE4823FD0339755934
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: box.germand.cyou
Sending IP: 188.166.160.26
From: Jalil Darvesh <marketing@cvsr.com>
Reply-To: butbox2019@yandex.com
Subject: send invoice, for the attached order!
Attachment: invoice.zip (contains "invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn23.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 09:48:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7k2u44pighzylm6vi5tz7ju5ipnnvxn6kxhborxekicp5nyeyvia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip fab54e71e831f385b3d547679fa69d43dadaddbe55ce1746e45204feb704c550

(this sample)

Formbook

Executable exe 524306af2db603c7db95227603c3014b67c27cfb2f88d12de2a599ece24575e2

  
Dropping
MD5 492017e064cab97dd8ea27abd3e5cfca
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 524306af2db603c7db95227603c3014b67c27cfb2f88d12de2a599ece24575e2

Comments