MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 379ac8e0ce02e5f6325e737165999ca7513c112c58cea7e1d639e159dc8f90f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 379ac8e0ce02e5f6325e737165999ca7513c112c58cea7e1d639e159dc8f90f6
SHA3-384 hash: d8c76694665854fb845905e563649d75c5a9e836069cfef90c02a5aea193f2f465985b9f96b39725f2ebcae733867059
SHA1 hash: af48fa694a4337d1ff0c571940964345f4c73935
MD5 hash: 1c99e33809786782d41d08624cbe1c4a
humanhash: harry-oven-magnesium-illinois
File name:Reconfirm064.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:881'266 bytes
First seen:2020-08-05 09:10:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:6V37Gbm8Y7SqMDhmyKw075QpWc+ZnXGzC9g:mIm8Y7IhLWc+x2WS
TLSH 501533322CD954B8089028DED63A155EC8207556CB0571B5DD9FE7EEC772CA733A0E4E
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Accounts Department <sales@jaykaltrading.com>
Reply-To: sales@jaykaltrading.com
Subject: Re: Accounts Department#5202008
Attachment: Reconfirm064.zip (contains "ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/379ac8e0ce02e5f6325e737165999ca7513c112c58cea7e1d639e159dc8f90f6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:12:12 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g6nmrygoals7mms6onywlgm4u5ityejmldhkpyowhhqvtxepsd3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/379ac8e0ce02e5f6325e737165999ca7513c112c58cea7e1d639e159dc8f90f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 379ac8e0ce02e5f6325e737165999ca7513c112c58cea7e1d639e159dc8f90f6

(this sample)

FormBook

Executable exe 478dce496a9eca179f7503d76fa70a27d85e2e8547b81b5c80fc7433122085c3

  
Dropping
MD5 58d2af59801de8b0f5aa6e6f9c31eb26
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 478dce496a9eca179f7503d76fa70a27d85e2e8547b81b5c80fc7433122085c3

Comments