MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2997d580c97d0e4cfbeebdbd6ae11e9a13343778cdab2f0ac3720500d0fbf3be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2997d580c97d0e4cfbeebdbd6ae11e9a13343778cdab2f0ac3720500d0fbf3be
SHA3-384 hash: 8f897fe87bdeb22aac4eb72f9aa56fa9164e92ce4ac0fffa7f557bfac0460f9b8fa4afc55e36092ab2dc48ce33f6210c
SHA1 hash: c8f2bfe9815060993c0f380f67c65337047bc48a
MD5 hash: acb330f45dd9d973f78e3eb804798e56
humanhash: butter-bravo-comet-spring
File name:ScanPMT.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:598'147 bytes
First seen:2020-08-19 14:31:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:OnJRPgkp9JlX8ZkSsA40AI95wmOcuwcg4ecgqmZL4m:OLLpd84l0XNu44eFq64m
TLSH 5AD43359197D41ED4E18E01A4BE3EB3EBAF30650D3E3FAFE866BC35805441986CAE15C
Reporter abuse_ch
Tags:Endurance FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: President - Le Thi Bich Như <server@hinet.net>
Subject: Full Invoice settlement
Attachment: ScanPMT.zip (contains "ScanPMT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2997d580c97d0e4cfbeebdbd6ae11e9a13343778cdab2f0ac3720500d0fbf3be/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 14:33:06 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgl5lagjpuhez67oxw6wvyi6tijtin3yzwvs6cwdoicqbuh36o7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2997d580c97d0e4cfbeebdbd6ae11e9a13343778cdab2f0ac3720500d0fbf3be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 2997d580c97d0e4cfbeebdbd6ae11e9a13343778cdab2f0ac3720500d0fbf3be

(this sample)

Formbook

Executable exe 8288e9e21f28be24c2d3839e26c3c726dc90e9955a8506816fb498044f9846b6

  
Dropping
MD5 07635d52fc102dc84f5922736c158677
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8288e9e21f28be24c2d3839e26c3c726dc90e9955a8506816fb498044f9846b6

Comments