MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6202a6df654b27001df4c46a156e73a9287ec50c67b6d53d07bb905949635e4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6202a6df654b27001df4c46a156e73a9287ec50c67b6d53d07bb905949635e4b
SHA3-384 hash: d31aada00f14b0f39631e19e56fb775a163320572acbe1d30152635362539afcad224fc3f54cd407c87bbef36a1e2d13
SHA1 hash: cc8e5543dceb0cbbbaea7837dd70fe372f6fdaa0
MD5 hash: 0746bd58992828e4f42b4e0740995dd2
humanhash: bacon-undress-oranges-florida
File name:40% TT Copy Attached.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:353'032 bytes
First seen:2020-08-05 08:20:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gYHSFQIYWkq/ak5Mlt/qWRlIk1zFiJksPYQ8KuEmNp2eehjddh:g2/TDy5M3CWyqsPYQ8REwppehpn
TLSH 0E74232F39D51923E0CF432DB94F59BADE6496A3AF350D2F0303F45BBA7666194C90A0
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mxserver10.masterweb.com
Sending IP: 103.25.223.11
From: Nerissa Lao Liwanag <laranerissa.liwanag@mizuho-cb.com>
Reply-To: account@mizuho-cb.com
Subject: 40% TT Transfer Copy
Attachment: 40% TT Copy Attached.rar (contains "40% TT Copy Attached.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6202a6df654b27001df4c46a156e73a9287ec50c67b6d53d07bb905949635e4b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:22:05 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mibknx3fjmtqahpuyrvbk3ttveuh5rimm63nkpihxoifssldlzfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6202a6df654b27001df4c46a156e73a9287ec50c67b6d53d07bb905949635e4b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 6202a6df654b27001df4c46a156e73a9287ec50c67b6d53d07bb905949635e4b

(this sample)

FormBook

Executable exe 8697eb117ba4ca2b18a9a7bbdcbd201cc062e2e79ccbc9d8ea785baf5b868657

  
Dropping
MD5 9b00f2972fea207be2d1e8bd7da4bd49
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8697eb117ba4ca2b18a9a7bbdcbd201cc062e2e79ccbc9d8ea785baf5b868657

Comments