MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a49f25ba44d858ff27e35a4ff1f2263cb4604dcb7e0f3e7c1d9aa459994a2ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a49f25ba44d858ff27e35a4ff1f2263cb4604dcb7e0f3e7c1d9aa459994a2ae
SHA3-384 hash: cc112c732ab4e990d54a6d491a7dc5aab5f448485cf8443a9b9791f16a92535b884fe0fb832dacd4cb6c27a0d287f57d
SHA1 hash: c9d09c12b0bbc066002c9aee31bbaf45637ea5e7
MD5 hash: 4d5d1321bccd2bfafbc68a516ea8c698
humanhash: michigan-romeo-black-winner
File name:Payment Copy H001510WHS.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:363'823 bytes
First seen:2020-05-21 10:38:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:y3hbcX0Fc0hM5I3+Lkg1kjCp/chuOlkyxvTP2EISw1KmJrS9Imt1t+/:Ft0qcvjU/c3OytTPASLm9Mjt+/
TLSH 7C7423E4906FEEA09484672A3D21482117DF7F47CDF698EC26375CE1BE67C0216872A7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: lysaghtgroup.com
Sending IP: 37.49.230.203
From: MOHAMED RASITH.B <lcpipoh@lysaghtgroup.com>
Subject: PAYMENT ADVICE AGAINST P.O# H001510/WHS
Attachment: Payment Copy H001510WHS.zip (contains "Payment Copy H001510WHS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49161.14608.28217.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:38:17 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
26 of 48 (54.17%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 8a49f25ba44d858ff27e35a4ff1f2263cb4604dcb7e0f3e7c1d9aa459994a2ae

(this sample)

FormBook

Executable exe d31a7e5639e4248f8debe115c8e6cdea00616a2b4a6a6757ea158dbe1c84748a

  
Dropping
MD5 f1afc41326ef3fc69d160827fc1cb0d1
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d31a7e5639e4248f8debe115c8e6cdea00616a2b4a6a6757ea158dbe1c84748a

Comments