MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1f7c4119b8a52916f4beb6b47ae83038cdbaf8f4d75bb63ccbd71025c0bed91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a1f7c4119b8a52916f4beb6b47ae83038cdbaf8f4d75bb63ccbd71025c0bed91
SHA3-384 hash: bf8712704a48551b9e4af8fc6bb1888dbfdd78fa62198e0e907f45c9fedf405493c36bbd58bc6eb7eb930752a33155dd
SHA1 hash: 0a61591298ce27aa7475c4e72cd84df01d989c58
MD5 hash: 9e13e69881cdca73ef7cc50d1883eb7a
humanhash: fruit-sodium-nebraska-cold
File name:SKM1009374.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-18 13:13:48 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hQFoKIm6icDc8IO/dgEF5PiZMdyKsFc1/NQ3H:aHlcnuE49KsFc1/Nc
TLSH 2D45D0367294EB19E17E53368D9A100403FAB8036611D76DBDDD22AC0B61BA74B33BD7
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: lv2-dxtjxq.cn4e.com
Sending IP: 219.239.95.10
From: 北京七星飞行磁材事业部 <cc@798.com.cn>
Subject: New quotation
Attachment: SKM1009374.img (contains "SKM1009374xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a1f7c4119b8a52916f4beb6b47ae83038cdbaf8f4d75bb63ccbd71025c0bed91/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:15:06 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uh34iem3rjjjc32l5nvupludaognxl4pjv23wy6mxvyqexal5wiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a1f7c4119b8a52916f4beb6b47ae83038cdbaf8f4d75bb63ccbd71025c0bed91

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img a1f7c4119b8a52916f4beb6b47ae83038cdbaf8f4d75bb63ccbd71025c0bed91

(this sample)

Formbook

Executable exe 7b1284dfea512883123452d9bd0ed61ab9af5ee56382664aada1914a42944e60

  
Dropping
MD5 07c46e95647003300012b5b573e5535f
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7b1284dfea512883123452d9bd0ed61ab9af5ee56382664aada1914a42944e60

Comments