MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 2 File information 4 Yara Comments

SHA256 hash: 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276
SHA3-384 hash: 13099b1025f92ee479f42d994f2c1968af8ead845f2c8fee706faab650af87311d6fbcfd922375547d3f69ec50fa3911
SHA1 hash: 345589ec90aeb8547c82ccc6bd96ab785c9923ff
MD5 hash: 0ab333af7d6758ebe4a52500940a0d74
humanhash: quebec-maine-august-failed
File name:LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar
Download: download sample
Signature Formbook
File size:301'926 bytes
First seen:2020-06-30 05:55:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Xs51EAHqQzOeKx5dykRbTYNL7eGlWXCPlaiTWXSjM2XGmgM+gqn2SdMNIz:XsTEgz3Y5dRfYNXb9IS+mgM+52Snz
TLSH 465423B21D9DB24F33A993A3E614691F3E13339BF0E0614D711367834826EADA5CC7A1
Reporter @abuse_ch
Tags:FormBook rar


Twitter
@abuse_ch
Malspam distributing Formbook:

HELO: mtk0.zmsyd.com
Sending IP: 45.95.171.11
From: PROCUREMENT MANAGER <p.m@zmsyd.com>
Subject: QUOTATION ON THE PRODUCTS ATTACHED
Attachment: LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar (contains "LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe")

Intelligence


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 31
Origin country US US
ClamAV No detection
CERT.PL MWDB Detection:n/a
Link: https://mwdb.cert.pl/sample/2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276/
ReversingLabs :Status:Malicious
Threat name:ByteCode-MSIL.Trojan.Kryptik
First seen:2020-06-30 05:57:04 UTC
AV detection:13 of 31 (41.94%)
Threat level:   2/5
Spamhaus Hash Blocklist :Malicious file
VirusTotal:No data

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276

(this sample)

  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment

Comments