MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be212619b97ee6954f65301efb5027961cebf3ac7ce8edd71dda5872442cea0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be212619b97ee6954f65301efb5027961cebf3ac7ce8edd71dda5872442cea0c
SHA3-384 hash: cfcd6b895f2c5bc52d4101f4fe844ab005a094fc5749c3dc86d186513a615c6e08bf8e213724d418faebfe871f4de63d
SHA1 hash: 056840758e7600d73a2e638990f42ee9c2526dca
MD5 hash: 8947567c8965dd5dbfbc5ad855a4870f
humanhash: berlin-california-apart-india
File name:Payment Slip.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:267'762 bytes
First seen:2020-05-22 07:15:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:tPhuKLxIpaSNRREoOR82Qn/OFD6XZvM6cXGZLNQ6xUB61L8mIlCbhMBZhwOJDIQe:JhuKJKDEoOurW96XK7WLp261RIAb6BZS
TLSH BE44235191E8EF51A6CBA663DB3787B707F21BCF5E24E20629D3988147369AE42C1C60
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Miriam Dim (ACCT PAYABLE) <sales@qualitech-solutions.cam>
Subject: AW: Payment Slip
Attachment: Payment Slip.rar (contains "Payment Slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 07:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar be212619b97ee6954f65301efb5027961cebf3ac7ce8edd71dda5872442cea0c

(this sample)

FormBook

Executable exe 9e5404dae4cf7c22028a3d09e99fa532a1f14e0636aa8112d177933a8b066b6c

  
Dropping
MD5 959cc1d1577952988bee9d96237dc04f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e5404dae4cf7c22028a3d09e99fa532a1f14e0636aa8112d177933a8b066b6c

Comments