MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b6cedbb68f70c266196e0d6996b449ec6106e359444afdf972cdc3c410f3a98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b6cedbb68f70c266196e0d6996b449ec6106e359444afdf972cdc3c410f3a98
SHA3-384 hash: 18b9b5f6ca4bcb247b42494e48f95644d6ce35445394c3206498abe49ec0afaf568bcb88a3229e3818cb29e4f9623b9a
SHA1 hash: 5f0d54e45680a8115959f70875145c51ed2da355
MD5 hash: 6235106e671112e3cf8ec44f84a8147e
humanhash: white-utah-crazy-quiet
File name:Payment Copy.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:293'809 bytes
First seen:2020-06-12 06:41:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:6w1LOwi0XjMwZMtEpoR+Twt0+Gz5DT4RfcWn8MLVw:6w1LPXZdpoAwbQ5Ofcuq
TLSH 8E542378BF4373124BE16059B0495D8DDA83A88FE0DDB1A0AFA743197C5C3AF90A654F
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: host.zotahealthcare.com
Sending IP: 158.106.129.174
From: Maersk SCM <Wajahat.shahid@lns.maersk.com>
Subject: Re: Payment Copy(Swift copy)
Attachment: Payment Copy.rar (contains "Payment Copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 06:43:07 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnwo3o3i64gcmymw4dljs22et3dba3rvsrck7x4xftodyqiphkma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 7b6cedbb68f70c266196e0d6996b449ec6106e359444afdf972cdc3c410f3a98

(this sample)

FormBook

Executable exe 4aceb03c756c45ef12b04c0e3ad7d49849169a5b43293901d11d271792d70307

  
Dropping
MD5 92fbd2559ef80dd54a817fc9d2f3842f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4aceb03c756c45ef12b04c0e3ad7d49849169a5b43293901d11d271792d70307

Comments