MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 614b107870af3963833133e1c0c5f5bfd6765833b865dcb60c075064ed3093c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 614b107870af3963833133e1c0c5f5bfd6765833b865dcb60c075064ed3093c1
SHA3-384 hash: 636bd0d1ab129704c4cfdd554bf8efeec9e616b8ef2544416ec632b6fe8ad7c5bf50a18345266f08daf95e4f97144646
SHA1 hash: 54063220547871bfa084fcafd5617ac6025036fd
MD5 hash: 740d20b73ab901afdab99a40851f74a9
humanhash: sink-dakota-london-pizza
File name:Shipping Documents.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:233'772 bytes
First seen:2020-04-16 10:42:04 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:BS9nP1uOOX0GOfocBlZ0eL0Io3LwbXy7KWl4MHKB:BEnPkOOX0NocB5XPbXQKWto
TLSH BC3423F2428EB34435165BA3C3F06BC04E2ED5C9C692325C12A8E7E4D5F51D6A9F099F
Reporter abuse_ch
Tags:COVID-19 FormBook zip


Avatar
abuse_ch
COVID-19 themed malspam distributing FormBook:

From: ALI @ Rajguru Dehydrates <sales@rajguruindustries.com>
Subject: FW: COVID-19 LOCK-DOWN / SHIPPING DOCUMENTS
Attachment: Shipping Documents.zip (contains "Shipping Documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.39031.11745.15185.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21092.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-15 23:42:20 UTC
File Type:
Binary (Archive)
Extracted files:
11
AV detection:
26 of 47 (55.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mffra6dqv44whazrgpq4brpvx7lhmwbtxbs5znqma5igj3jqspaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 614b107870af3963833133e1c0c5f5bfd6765833b865dcb60c075064ed3093c1

(this sample)

FormBook

Executable exe d13d1c39956ee9f7123416a5b52f9f631aaeca544d1af3fb48b446485c59d377

  
Dropping
MD5 c2f3f6d7506b6e46e562436b94c3f304
  
Dropping
SHA256 d13d1c39956ee9f7123416a5b52f9f631aaeca544d1af3fb48b446485c59d377
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d13d1c39956ee9f7123416a5b52f9f631aaeca544d1af3fb48b446485c59d377

Comments