MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17eff131672ab095f9227f238d69b8c1ad788f27ffe45a9ddf1d5586e83e06ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 17eff131672ab095f9227f238d69b8c1ad788f27ffe45a9ddf1d5586e83e06ab
SHA3-384 hash: 3bdc370401e38b75091781b596202aaf2b0627d80b2f926ed34afbf55499366097493856150e3a43fa8ec8cd48af4026
SHA1 hash: 3558a618d6aad9037c97091654b2548fd0de7669
MD5 hash: 2ea874d409822a28ade3924c11601e7d
humanhash: friend-bravo-october-jig
File name:ORDER_29741.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:331'858 bytes
First seen:2020-05-07 07:11:27 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:geV1lMzjjYmIjeHMu5koh7QuaZHJtCQ11/F3tYFF5ZyxeGk9JtiSgtwAbh:dV4zImkT5YKAZ9zintwAN
TLSH C4642313291CF16E0C66DC23FE8BFDE134B6DA70420549E1B41BBD4A4C6A5FF9904ADA
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: William Thani <w.thani@qualitech-solutions.cam>
Subject: AW:URGENT ORDER
Attachment: ORDER_29741.rar (contains "ORDER_29741.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 12:49:22 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c7x7cmlhfkyjl6jcp4ry22nyygwxrdzh77sfvho7dvkyn2b6a2vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 17eff131672ab095f9227f238d69b8c1ad788f27ffe45a9ddf1d5586e83e06ab

(this sample)

FormBook

Executable exe e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b

  
Dropping
MD5 b9c6aad2753d835eefeeae486fac18ba
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e3f68e3679fc2ab587e712ce137e107318ebaa6bd5e724a76200bb10c945312b

Comments