MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d0c5b8ada78384c5f0c4239797189173e795533b34a9f8f687367c5aa72e008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d0c5b8ada78384c5f0c4239797189173e795533b34a9f8f687367c5aa72e008
SHA3-384 hash: a48a02a9ceb0d281d1ccb20e3aeb7f3b08d4cf4b5ce0145d4f810f47bcc387bcbdf94eacda45f7fa632cea5d625f44da
SHA1 hash: c87cec3dabd73789512b6b4ac9c56e6b268843df
MD5 hash: 19c42260b8bb57bb36961b64a94fc313
humanhash: black-sad-six-michigan
File name:DHL Shipment Notification 20072045127.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-30 07:52:25 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:MUXohgxMSZdV1RKs9Oadnykv9+GQBhlaM90diLcAgkRSBmJlsD6xzlr:nMer15QaP9+NvQT8Lom4D63
TLSH 3C4512BC6B28DC13D5B95B3D78632B4442F09C2B7A4AEB57769C39042F7A78007D64B4
Reporter abuse_ch
Tags:DHL FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: k023.k023jp4238.info
Sending IP: 160.16.147.59
From: DHL CUSTOMER SUPPORT <customerservice@dhl.com>
Subject: DHL Shipment Notification: 20072045127
Attachment: DHL Shipment Notification 20072045127.img (contains "DHL Shipment Notification 20072045127.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 01:22:43 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dugfxcw2pa4eyxymii4xs4mjc47hsvjtwnfj7d3iont4lkts4aea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 1d0c5b8ada78384c5f0c4239797189173e795533b34a9f8f687367c5aa72e008

(this sample)

FormBook

Executable exe 474af43d204f161ca0f2138812a1081fa7a09e5a64dc862cda83a8f23a3ff88e

  
Dropping
MD5 07d7d1f8aaec814b28f44fda199a974f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 474af43d204f161ca0f2138812a1081fa7a09e5a64dc862cda83a8f23a3ff88e

Comments