MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbc2dcb6615f34cd3518733f34ce939dcf3bb576a5464022977e62e7480480e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbc2dcb6615f34cd3518733f34ce939dcf3bb576a5464022977e62e7480480e4
SHA3-384 hash: f3e313b062cafc07b4d79295a6b6dee7d5177299de2b6a7883c301b4881e49e49a79f309260e7d9913e153a33cae7956
SHA1 hash: f6083d7a8d967d7e6298150b789690fbd81911e7
MD5 hash: 8633c9faffe606b47606f62f63d160e8
humanhash: mountain-muppet-queen-fillet
File name:BKG#339LN2035492.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:362'873 bytes
First seen:2020-09-28 05:25:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:kHfkCBobZSvnQ6GnKZTwPXFDZ5FhkNyCxsstPaAUYt6Bzpf7L/ShLS+pPHBTB/cU:k/ZBo0n/ZTu1DBhkNJDPjUgmzpzL/ShT
TLSH 637423B96EBF5FF82743F49DB2C18579A29814A61162CA167C7660C9353E7073E33832
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Nhung Cam Tran (DHL) <Nhung.Cam@dhl.com>"
Received: "from dhl.com (unknown [95.211.208.58]) "
Date: "28 Sep 2020 00:35:49 -0700"
Subject: "FW: NEW BKG#339LN2035492---SHIPPER ANCO - CNEE for lgpartner.ch"
Attachment: "BKG#339LN2035492.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.437.107.6768.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbc2dcb6615f34cd3518733f34ce939dcf3bb576a5464022977e62e7480480e4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-09-27 04:15:22 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pbnzntbl42m2niyom7tjtuttxhtxnlwuvdeaiuxpzroosaeqdsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fbc2dcb6615f34cd3518733f34ce939dcf3bb576a5464022977e62e7480480e4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip fbc2dcb6615f34cd3518733f34ce939dcf3bb576a5464022977e62e7480480e4

(this sample)

Formbook

Executable exe 10a9aab39489aa507d35bb18b357ca6c9f8642d8fa27fc1ad9c7de03c8e9415d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10a9aab39489aa507d35bb18b357ca6c9f8642d8fa27fc1ad9c7de03c8e9415d
  
Dropping
Formbook

Comments