MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89b44ca030f49c36a138e2c14f6ce2e9d88a36a610033bc310200d44c6061445. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89b44ca030f49c36a138e2c14f6ce2e9d88a36a610033bc310200d44c6061445
SHA3-384 hash: ba505efe80d6b72ae5bf87751c0e6b26a45c48a09f90886035895fbd7d04865ce7829c1f740faa1700673e90b8a7bcf7
SHA1 hash: b1600b9282d890dcd47eeef27b1a3dd6542fff11
MD5 hash: 1aa7c6c750e7fae09ae3e462e2307b67
humanhash: salami-montana-cold-uranus
File name:New Order 984994.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:420'564 bytes
First seen:2020-06-20 05:59:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:cudgVOJc/N/Y52jR9WkUYr9EQ39EwkqhP:cHv/e56KkHyQ39z
TLSH C9942333825D6AE1A20B64DF2D48750A3276C3382CF4CC8973B911FA75B12BBD9CB559
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.sandrovicari.cc
Sending IP: 45.95.169.67
From: Hamza Elsmadi <hamze@alqariab.de>
Subject: Re:Purchase Order
Attachment: New Order 984994.zip (contains "New Order 984994.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.22623.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 06:00:06 UTC
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rg2ezibq6sodnijy4lau63hc5hmiunvgcabtxqyqeagujrqgcrcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 89b44ca030f49c36a138e2c14f6ce2e9d88a36a610033bc310200d44c6061445

(this sample)

FormBook

Executable exe bb0c96dd4021c9d4f7b7f85ce5372ef74f7ba8c1a257d2c152db052020219799

  
Dropping
MD5 3a92350e5c65597f42e06a910a067f12
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bb0c96dd4021c9d4f7b7f85ce5372ef74f7ba8c1a257d2c152db052020219799

Comments