MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3e06adac1de1ffc979fb03a2568122dd2d9df5317ac929c65b992502613a073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3e06adac1de1ffc979fb03a2568122dd2d9df5317ac929c65b992502613a073
SHA3-384 hash: 30b38f7906ff1c5bd192bab0e9a4a9ffc5147bce89b1fde37fe0af868ef84738ada19835b2404be8cd9efaf6d7028032
SHA1 hash: 5cccde19188452521633249332e746c2765a6f3a
MD5 hash: 1ebd9f034bf51511c62005f93a9cd7f4
humanhash: kansas-virginia-delta-wisconsin
File name:Purchase Order-0096005.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:460'472 bytes
First seen:2020-07-29 05:26:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:eeTm03SG5Cz3W7fFmpBCHVk0o8ZAA7X4fJfm7rDHSzu9VBgzsi42F+9OERmSXuv6:eeTtlq3odKBahAweqKzF620B+vmkBe
TLSH 39A423332D5A1615FEDEA5B23AB173910ACB4A442B5EDC4CCA99D1A0B14F223F1D0B73
Reporter abuse_ch
Tags:FormBook Hostwinds zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-752572.hostwindsdns.com
Sending IP: 104.168.237.25
From: Adnan Nathanial <info@mv-exports.com>
Subject: Purchase Order/Taraz Technologies-TR27072020
Attachment: Purchase Order-0096005.zip (contains "Purchase Order-0096005.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22205.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3e06adac1de1ffc979fb03a2568122dd2d9df5317ac929c65b992502613a073/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 05:27:09 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ypqgvwwb3yp7zf47wa5ck2asfxjntx2tc6wjfhdfxgjfajqtubzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/c3e06adac1de1ffc979fb03a2568122dd2d9df5317ac929c65b992502613a073

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c3e06adac1de1ffc979fb03a2568122dd2d9df5317ac929c65b992502613a073

(this sample)

FormBook

Executable exe 89819dbac176147b14b878250b43d1954844e6f0d4bace8b4607bad4405ca96b

  
Dropping
MD5 e90d5fb481511c5d3c844529fe20ee00
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 89819dbac176147b14b878250b43d1954844e6f0d4bace8b4607bad4405ca96b

Comments