MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dae59d3a42418044bb457d5ea97b60e1af02016c687514c673b21bc2d3c7d16e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dae59d3a42418044bb457d5ea97b60e1af02016c687514c673b21bc2d3c7d16e
SHA3-384 hash: 6a6f68a57c3cc3e95001f9b990047b398acea82020843bac9fe04d5fd99caec1458b0f63f7ea28692b199aeb52f9b0c0
SHA1 hash: 9f88472b863e36e1d9a235b77ecdab7aa852ded5
MD5 hash: 86206089c19f95caf16157388ddd67db
humanhash: hotel-missouri-avocado-princess
File name:QUOTE_USD78,500-INV.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:260'407 bytes
First seen:2020-05-13 06:14:47 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:sOwU9hFE+obkVw4ESAX0kUtGmg68BvEIJsxGd1c4SJ4iWi:972YVCJXDTBmxE14Jii
TLSH A144127BD0F6004E57E2F347474D52E1AEB92CA4B2AE7D2C839E1D537105D0EDA4EA60
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: HANNAH DOUGLAS <h.douglas@qualitech-solutions.cam>
Subject: RE: CONFIRM QUOTATION FOR PAYMENT USD$78,500
Attachment: QUOTE_USD78,500-INV.rar (contains "QUOTE_USD78,500-INV.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 06:37:18 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lsz2oscigaejo2fpvpks63a4gxqealmnb2rjrttwin4fu6h2fxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar dae59d3a42418044bb457d5ea97b60e1af02016c687514c673b21bc2d3c7d16e

(this sample)

Formbook

Executable exe accddeb954844341b87c006344f21c50757cd228d2f071d39e8707209b1a49f9

  
Dropping
MD5 124b6cfd46608c797512542d3b6db823
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 accddeb954844341b87c006344f21c50757cd228d2f071d39e8707209b1a49f9

Comments