MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e53f7c0b3903e52d246a7ff81febc6e2089e5d9723cdff6079c1cc0311d1c95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e53f7c0b3903e52d246a7ff81febc6e2089e5d9723cdff6079c1cc0311d1c95
SHA3-384 hash: 3436e6ec9f751a16c079c28f388a1787d0226a53587f0bbe5da38f7a85affc161a365c523327f27d103c71be719db1b6
SHA1 hash: d1d62e830a2ae9b048da816de4ffe3cb33876c1d
MD5 hash: adf139966d3025bb4a6d180ece66a3ed
humanhash: finch-idaho-west-twelve
File name:Scan_25052020.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-25 12:36:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:7KEFXkOeSi0kEiIUi3AmbGdw/nwQgqIh7HTpomVBplK+SmVMSvInjz7k2:BFXpe50kEtUisYZg91tVVKSBm
TLSH 2D45AE7843AAB71BC65E52B8C964404E73F18DA7950EE709A84A3DED1F3B743A8035C7
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sv7284.xserver.jp
Sending IP: 183.90.237.125
From: Mklein <mklein@harrisford.com>
Subject: Wire confirmation
Attachment: Scan_25052020.img (contains "Scan_25052020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.UZF.29913.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 48 (33.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 6e53f7c0b3903e52d246a7ff81febc6e2089e5d9723cdff6079c1cc0311d1c95

(this sample)

FormBook

Executable exe f03893940d05b4b6121df9493b25f4eb1ba37caf2d3c1333d90891997430fe81

  
Dropping
MD5 a43dba454dfe651de7019c2a2ce397a6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f03893940d05b4b6121df9493b25f4eb1ba37caf2d3c1333d90891997430fe81

Comments