MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53440a1eab20033b5567d4c6582b0ab159fee1193dde09e7a3ac5d35c61a94c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53440a1eab20033b5567d4c6582b0ab159fee1193dde09e7a3ac5d35c61a94c4
SHA3-384 hash: d693870b4f6b56a9dc1e7a6db4f728392eb2a7770ddadf01b646b765ca47b51785c1300ff213fbb3a09f9cc0d9ac3bb1
SHA1 hash: 113f4482c5175237adbdf36ed5c19c7ad216e4bc
MD5 hash: a3b2837e01674ca8ad342c96bafa9f46
humanhash: pizza-uranus-gee-venus
File name:ORDER_8431.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:293'414 bytes
First seen:2020-04-30 09:52:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:0PoGQ6PMN76Tvf8VlzLddte3mDuPOItJ5/0BAGvcKSKIL0Vyg5:0dQdplzLddte8uibS1syg5
TLSH B35423C421C0BBFE89E9ED5032AF9BC077BDEF502605BA2431551E9841268EB762F477
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Gary Stein <g.stein@qualitech-solutions.cam>
Subject: RE: RE: URGENT ORDER
Attachment: ORDER_8431.rar (contains "ORDER_8431.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 10:36:32 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kncauhvleabtwvlh2tdfqkykwfm75yizhxpatz5dvrotlrq2stca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 53440a1eab20033b5567d4c6582b0ab159fee1193dde09e7a3ac5d35c61a94c4

(this sample)

FormBook

Executable exe 31d1428b910df6a6b0bc62b597f5c4c88514cba2ecd8c8fd28410ab97952b7cc

  
Dropping
MD5 54927f03f5647a4b662837bdede5166b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 31d1428b910df6a6b0bc62b597f5c4c88514cba2ecd8c8fd28410ab97952b7cc

Comments