MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9b57ea751425163e09d5c5555188abfc152c5790d5a742650181ec421ee1d47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d9b57ea751425163e09d5c5555188abfc152c5790d5a742650181ec421ee1d47
SHA3-384 hash: 53c125474d621e62ec26e16868ab95ffacfe449a3a6625885de9a1e3a52b0aa6f968c4e0e5f882c1765d7edbafe1f25f
SHA1 hash: b34b3353a44459862a5a13a411a6cad39d055548
MD5 hash: 15742c8b55dfe9d312e638328718b096
humanhash: mountain-aspen-colorado-april
File name:AWB DHL 6357297368.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:271'306 bytes
First seen:2020-05-11 08:40:51 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:X+7onjd+lGwPON9TEu2aUnFBwutmB0q1Yu3/OP10vBdVCfF89xI:8ujgURNCaUnFVC1vPOP10vzQ2xI
TLSH B84422B06853A316EBFFD507736F21AA131AA28A0665197B533167F333670004ADD9EF
Reporter abuse_ch
Tags:arj DHL FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: coho.com
Sending IP: 217.61.98.69
From: Nathaniel - DHL <nathaniel.johnston@dhl.com>
Subject: AWB DHL 6357297368 - Notification
Attachment: AWB DHL 6357297368.arj (contains "AWB DHL 6357297368.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:25:55 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3g2x5j2rijiwhye5lrkvkgekx7avfrlzbvnhijsqdapmiipodvdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj d9b57ea751425163e09d5c5555188abfc152c5790d5a742650181ec421ee1d47

(this sample)

FormBook

Executable exe 8509ca4c5f81525eb6f300294703c9c66af0369374bc064ac024c9dae62c7092

  
Dropping
MD5 cebd17c55de5642bd05e7a5b6dc354a4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8509ca4c5f81525eb6f300294703c9c66af0369374bc064ac024c9dae62c7092

Comments