MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd792d4dc5f8a4a0b08f4c8a9ea07372721b82f9d08fe223f1071165c106d0b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd792d4dc5f8a4a0b08f4c8a9ea07372721b82f9d08fe223f1071165c106d0b6
SHA3-384 hash: 0c4f1e82246b1267b82510ddd28859b6120ab72ec92103673107ffc935a3dcf13537aa8bf6dc4e222ee05055cd48dbeb
SHA1 hash: 80077405ea5e324af4f5367066055b1a099f05f4
MD5 hash: dd70388a7ab2ee599c3743dbb32ca3b8
humanhash: yellow-single-mirror-cat
File name:img_06042020.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-04 07:08:15 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:egXX5EUB7gIglvI9yDoS+sUaXAxJpc59yv90VyF1SYrjTX7/c/Jkf8SHt6Oa2:RXTVgIglvI9yT+sQxo5Yvln7US86
TLSH 0545AE2653A8CB66D69D47BEC9D151404BE58DE78E4BCF49AC9974FE0A333A3D80210F
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: relay02.poa.svr4u.net
Sending IP: 180.222.177.75
From: Eric Zau <eric.z@zjlmi.com>
Subject: Payment did not go through please confirm details
Attachment: img_06042020.img (contains "img_06042020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 00:39:35 UTC
AV detection:
10 of 31 (32.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3v4s2tof7cskbmepjsfj5idtojzbxaxz2ch6ei7ra4iwlqig2c3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img dd792d4dc5f8a4a0b08f4c8a9ea07372721b82f9d08fe223f1071165c106d0b6

(this sample)

FormBook

Executable exe 7fab1d558e165d232858902d7774749256fb81c20ded2487bbc3b7b2cd0d1507

  
Dropping
MD5 1b72515c39d35164db37e1655399502d
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7fab1d558e165d232858902d7774749256fb81c20ded2487bbc3b7b2cd0d1507

Comments