MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72e3a0ebf4be562b06e33b5f013748cc26706d3d0c012f6169577896134d8048. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72e3a0ebf4be562b06e33b5f013748cc26706d3d0c012f6169577896134d8048
SHA3-384 hash: 446bec356f61e2c91d71e76ba5998d25e12a749dd9423cbdb6d2f72da4baea9bcc11911e7a8d62c48b4f21c8b98256ce
SHA1 hash: 9079bb2295baf3d28de726957afdcaa759f97dd1
MD5 hash: b90b7884c7f6df3ad7532dd9a30517d3
humanhash: victor-diet-finch-fish
File name:Quote022.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:582'883 bytes
First seen:2020-08-18 13:12:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lkoXlp7D8015pOYXNiYBasU2V13cMG9ERLD9vHdQfWLd6n7OKQS7a08Q:lkmlpM015ptXj4sUO5JRB9IAdWQ+abQ
TLSH 70C433D6C36754449CC64E28F9AF242BF53FD35CAB0EA1B640744B781A3D92322F9698
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Helen He < server@hinet.net>
Subject: Reminder for Quotation
Attachment: Quote022.zip (contains "CyD9nR9riEc1Snz.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72e3a0ebf4be562b06e33b5f013748cc26706d3d0c012f6169577896134d8048/
Threat name:
ByteCode-MSIL.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:14:08 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=olr2b27uxzlcwbxdhnpqcn2izqtha3j5bqas6yljk54jme2nqbea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72e3a0ebf4be562b06e33b5f013748cc26706d3d0c012f6169577896134d8048

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 72e3a0ebf4be562b06e33b5f013748cc26706d3d0c012f6169577896134d8048

(this sample)

Formbook

Executable exe 52487a544f6987349f5cab38dd1cfdd2aac0ac6efff911fc171a1ae844bd9f87

  
Dropping
MD5 0db868bd1f683eda8e50b437606ee68e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 52487a544f6987349f5cab38dd1cfdd2aac0ac6efff911fc171a1ae844bd9f87

Comments