MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 446e4a42c96ed7f4e0c512476032760da13bd022dc78638396425685fd775360. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 446e4a42c96ed7f4e0c512476032760da13bd022dc78638396425685fd775360
SHA3-384 hash: 3f43fdb0e77ca72458e02f1c0fae8429efdb0fc6dd419840da3dc5fd69afb3b0e79ba344cfbdafc43b80aaf505380f24
SHA1 hash: 10d6e5d5b9f84a5fc3d96df470ec1b6e962564fc
MD5 hash: 6c2bceff3404751413e68d8df5601ec3
humanhash: oranges-happy-connecticut-sad
File name:QUOTATION.LZH
Download: download sample
Signature FormBook
Create hunting rule
File size:265'284 bytes
First seen:2020-06-29 15:41:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:vgDBpwDgs9x8cmUCGgkn7RguAh0OT9HxyoQu9TAjNi5kLe2NIJ443R/WjTTyNo:vgDMt9CUz/3I04xFTA7ZNuHRgTJ
TLSH 5E44234EDCE2B6F2D2879C4E0401DAE9552A31E47060B869CEC7358C2DBAF1DC57A973
Reporter abuse_ch
Tags:FormBook lzh


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.tiantuct.com
Sending IP: 45.95.169.92
From: PMRG LTD<info@tiantuct.com>
Reply-To: fra_white33@yahoo.com
Subject: QUOTATION
Attachment: QUOTATION.LZH (contains "QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/446e4a42c96ed7f4e0c512476032760da13bd022dc78638396425685fd775360/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 15:43:06 UTC
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=irxeuqwjn3l7jygfcjdwamtwbwqtxubc3r4gha4wijlil7lxknqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 446e4a42c96ed7f4e0c512476032760da13bd022dc78638396425685fd775360

(this sample)

FormBook

Executable exe a601e4a16b16f0eacedc679e3f367d990c0cc913470d138b4d3e6d3ba156f7b7

  
Dropping
MD5 f2fa083a8f5e187ce3b1ae7048a86a80
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a601e4a16b16f0eacedc679e3f367d990c0cc913470d138b4d3e6d3ba156f7b7

Comments