MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d446e5e07743c1c43cdab9d2720f77e81e7d11686e7491b12eaf65dca7faa5b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d446e5e07743c1c43cdab9d2720f77e81e7d11686e7491b12eaf65dca7faa5b0
SHA3-384 hash: afb367a39419cb70642d62bd5a55fd4df9415a2bd78b1645d3cc630e5c1cef1f3d170d1bf0a7c7bcb2e67dd0932fdf33
SHA1 hash: c552090c6da7e67ed329561162c9532304e2401a
MD5 hash: 05cfd228fd35757e38d139a0c393fe67
humanhash: oranges-kansas-cardinal-kentucky
File name:New order.r21.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:206'773 bytes
First seen:2020-05-04 21:06:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:LRY6irq0Zn+tEm0ojYEUrhS+kYrbgvQvHsvMWUN5rXJF0G1RHN7rdE/ZBN/P3EnT:LRSrQtj0o9ZQggbN3iQH58d37+
TLSH 0D14129C9D4AB237110FBF1E9054B7A0E59727B5104C9E047DEEECE4E2948A2E30893F
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: WIN-CWF27I845LQ
Sending IP: 103.141.136.76
From: Mr.Johan Amstrong <johanorders20@gmail.com>
Subject: New Order
Attachment: New order.r21.zip (contains "New order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44190.12620.10623.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21106.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 21:37:08 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rdolydxipa4ipg2xhjhed3x5aph2elinz2jdmjov5s5zj72uwya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip d446e5e07743c1c43cdab9d2720f77e81e7d11686e7491b12eaf65dca7faa5b0

(this sample)

FormBook

Executable exe 385f26b9c329243b4f4b3bc599914217e81a6ebae5cb0827230585469c5372a1

  
Dropping
MD5 9a6826ab2898f6051f3da1468e79b34d
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 385f26b9c329243b4f4b3bc599914217e81a6ebae5cb0827230585469c5372a1

Comments