MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff3f5406a4f691de4c186fadb79aa73836f8a420808d69a4ba027ab89e8874a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff3f5406a4f691de4c186fadb79aa73836f8a420808d69a4ba027ab89e8874a7
SHA3-384 hash: 026f7339684a82db255666596994420fa10fed74ec159ce3ac5dc98b0d17196e3711d658bb80745095fb10092a2d1564
SHA1 hash: 188047ce9e903ac94b53cb77c8729f5604678657
MD5 hash: bc8a44b4fbf82fa62def6a8eeb3bc157
humanhash: mobile-ceiling-mike-salami
File name:1-29.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:372'973 bytes
First seen:2021-01-29 06:31:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ri+ty6XuG9ZfIN92x1qS8axiNmZ3QBPhKmZCtaHb4vbSFBg5nmbUUfk2GdKlfQR9:ri+U6+GC03qS31J+g84eXEnmJk24Kg9
TLSH B48423D5E51AF0284621CBA9E54D9ED5FC60E894E49F0B0D9B30694E40DCDCC5D37AEC
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "DHL DELIVERY <office@cowbown.com>" (likely spoofed)
Received: "from slot0.cowbown.com (slot0.cowbown.com [203.159.80.100]) "
Date: "28 Jan 2021 23:39:37 -0500"
Subject: "CONFIRM YOUR DELIVERY ADDRESS"
Attachment: "1-29.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.MSIL.Burkina.1.18434.15394.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff3f5406a4f691de4c186fadb79aa73836f8a420808d69a4ba027ab89e8874a7/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-29 03:55:29 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=747vibve62i54tayn6w3pgvhha3prjbaqcgwtjf2aj5lrhuiostq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff3f5406a4f691de4c186fadb79aa73836f8a420808d69a4ba027ab89e8874a7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip ff3f5406a4f691de4c186fadb79aa73836f8a420808d69a4ba027ab89e8874a7

(this sample)

Formbook

Executable exe 110c39365be1d4d0307080c7a264654fa63725b7e99dbc271d8dedaa10300217

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 110c39365be1d4d0307080c7a264654fa63725b7e99dbc271d8dedaa10300217
  
Dropping
Formbook

Comments