MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cacc35f1f1ca0a9550e64115210b1d97eb97884fbeb2fcecaa719ce22fb26f4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cacc35f1f1ca0a9550e64115210b1d97eb97884fbeb2fcecaa719ce22fb26f4c
SHA3-384 hash: 0defc24a74ad7614ce44dc7384239f91d43b02ffc17a2e34de986057ec9cfa16273af9d77f23ea124194fb6985992b63
SHA1 hash: 3dd0e4c815b9c39614a4a60314af9cc324f0fc83
MD5 hash: 6bd42748f1e41b46857d744b2a2d8a35
humanhash: iowa-fanta-oregon-bulldog
File name:Respirator mask.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-16 11:26:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:2XbfsE1iqdDP85OU+ySPJozZ1dFhAmdLBLdfChYuvvQV0:2zsE1iqdDPAOUuORcm5P8+0
TLSH 6945BF2C06E87A17C67E837FD2A5010C52D2D1661B87E78DA90E60FA1F1F35BF56224B
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qproxy6-pub.mail.unifiedlayer.com
Sending IP: 69.89.23.12
From: vnexp.query@dhl.com
Subject: Your order has been received
Attachment: Respirator mask.img (contains "Your orders.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.UTO.11488.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 11:28:05 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlgdl4przifjkuhgieksccy5s7vzpccpx2zpz3fkogooel5sn5ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img cacc35f1f1ca0a9550e64115210b1d97eb97884fbeb2fcecaa719ce22fb26f4c

(this sample)

FormBook

Executable exe 2ff5f726080125732c91296d7bce8b496e5d50d2fb8b3d028f0f41990565015e

  
Dropping
MD5 0b746a562bc4038bd7704abe73b27e02
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ff5f726080125732c91296d7bce8b496e5d50d2fb8b3d028f0f41990565015e

Comments