MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fad8c260778b6e2a684ae71519c759344f2f5dc06879dd27f5bbb87b7d06f3d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fad8c260778b6e2a684ae71519c759344f2f5dc06879dd27f5bbb87b7d06f3d9
SHA3-384 hash: 13c13a5a3d6d830c7e02390a187c077acbda375cc2222c9bab12c074ef31a05a108442b91a37144f25c4378b829a07e7
SHA1 hash: 8d21c221941509e6abfadc74c9700324f70d75a8
MD5 hash: ace0e2e39f8318e86aedc750075369fd
humanhash: east-india-black-tennis
File name:Nepal Pharmaceuticals Laboratory.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:465'732 bytes
First seen:2020-08-03 15:07:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/OB8z37s5NP7+sHbA6Rbu7eiHAHpbbKRbeC6OcjR8:/Oq77s5lCs7RZ8gHpbbKRSC6OcjR8
TLSH C6A423B0585B847F2AD90A5D65B22019452ACCFF9226704FE939C27DDE33E96BB030DD
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.vreo.net
Sending IP: 143.95.90.162
From: nplmkt@npl.com.np
Reply-To: alfa@qualityservice.com
Subject: Nepal Pharmaceuticals Laboratory Pvt. Ltd. (NPL) / Request For Quotation
Attachment: Nepal Pharmaceuticals Laboratory.zip (contains "Nepal Pharmaceuticals Laboratory.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.413bd9d03c8347c4.19761.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fad8c260778b6e2a684ae71519c759344f2f5dc06879dd27f5bbb87b7d06f3d9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 15:09:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lmmeydxrnxcu2ck44krtr2zgrhs6xoanb452j7vxo4hw7ig6pmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/fad8c260778b6e2a684ae71519c759344f2f5dc06879dd27f5bbb87b7d06f3d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip fad8c260778b6e2a684ae71519c759344f2f5dc06879dd27f5bbb87b7d06f3d9

(this sample)

FormBook

Executable exe 4951d233fb87fd6036e0baadf6b91ceb91ebe5d61fc048a27949949c8476b82d

  
Dropping
MD5 413bd9d03c8347c4a3d654c9d478781b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4951d233fb87fd6036e0baadf6b91ceb91ebe5d61fc048a27949949c8476b82d

Comments