MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88417d4fa392432b036e9d1e1d47fe6e23798410f891e70a90541d0e756ae037. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88417d4fa392432b036e9d1e1d47fe6e23798410f891e70a90541d0e756ae037
SHA3-384 hash: e3b5034e6d090e32e79f22a462c6df46f39a88611319a2371a2c710418da713d899b65fee5f057fc7f2a05ff1a162379
SHA1 hash: 5389572558b2b15449b7e1154059b73d46a39983
MD5 hash: 4ea7f938e2e103041a3d48f75d329ff7
humanhash: ohio-ceiling-florida-carbon
File name:STE_STE-20-0065S-1.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:229'245 bytes
First seen:2020-05-29 06:03:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:fCS4PEQmFjjHBGLj73IHFay6vlOV3SsgktfzfdnZ6aUiM4I4i:fCjy4n7IHFaLOV3SstJrrLi
TLSH DA2423E9B98C4FE164004ABF89D497BA039DCBE7741DBE458C0555A1A23C6B2B4B2F43
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: thaimartin.co
Sending IP: 111.90.145.52
From: Hemelia.Hamid@iconoffshore.com.my <Hemelia.Hamid@iconoffshore.com.my>
Reply-To: pewal.wsb@gmail.com
Subject: Re: ENQUIRY
Attachment: STE_STE-20-0065S-1.rar (contains "STE_STE-20-0065S-1.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-29 06:36:43 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 88417d4fa392432b036e9d1e1d47fe6e23798410f891e70a90541d0e756ae037

(this sample)

FormBook

Executable exe 19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c

  
Dropping
MD5 a0865b9ab2bf3899fa4df3f27acae6ca
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 19e839e299b4a6f1ddbfb8f1adae91011b0cd40d9d095b5de75004becd7a364c

Comments