MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7df5e3dbbf4aba798bc3fc963731c0c6aa6645301235c72eddb8cd374265ac14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7df5e3dbbf4aba798bc3fc963731c0c6aa6645301235c72eddb8cd374265ac14
SHA3-384 hash: 60a42fb5f4f8580caf94659a76765068d179515efbc52f242092d1843f2d825845089ff1c1c85fcc8bad5de71a09ecc2
SHA1 hash: dbd360c355b16913ac6ce7183073530a561263de
MD5 hash: 4e57b2683adb0ff4141215d9a06bf57a
humanhash: massachusetts-carpet-lemon-ack
File name:130003150.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:327'812 bytes
First seen:2020-08-14 09:26:05 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:RdcqxZm87jSrM50zsHoKYaecdZCVoU3mUUmX8Tu+OVfMJYuu:RdThQM5CKYae0CSU3mUUxTu+skGuu
TLSH C064231944D6AB5BF08B1D916C363BA9726C7678691B0BD0B84CCF92410ECB432AB7DD
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dhl.com
Sending IP: 37.49.230.8
From: Norul Hudha Jiavudeen (DHL) <norulhudha@dhl.com>
Subject: DHL SOA OVERDUE NOTICE - 130003150 victim-domain
Attachment: 130003150.zip (contains "130003150.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.4036.4719.15671.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7df5e3dbbf4aba798bc3fc963731c0c6aa6645301235c72eddb8cd374265ac14/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 09:27:04 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=px26hw57jk5htc6d7sldomoay2vgmrjqci24olw5xdgtoqtfvqka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7df5e3dbbf4aba798bc3fc963731c0c6aa6645301235c72eddb8cd374265ac14

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 7df5e3dbbf4aba798bc3fc963731c0c6aa6645301235c72eddb8cd374265ac14

(this sample)

FormBook

Executable exe e65997e20f521c8eee713623c45c9600a7a05629c85d73c9dd2bdf696f43e5de

  
Dropping
MD5 4300f14f031e8a4330a8c56894b22fca
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e65997e20f521c8eee713623c45c9600a7a05629c85d73c9dd2bdf696f43e5de

Comments