MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc867430c8efb6bfa3c5c95cc1378607a14d740b5597a69b9a05dd278fc542ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc867430c8efb6bfa3c5c95cc1378607a14d740b5597a69b9a05dd278fc542ed
SHA3-384 hash: 671cc4eb053a13ea641810a965fe29b226c5ed8bdbe1648cd4b37daa60c87698ff75df8f3fc2be4b5a7f21bbddd3de38
SHA1 hash: 55b5c94ee0cd0b43af44f3beff2eead12d08c4b1
MD5 hash: 8ad3c1e4cc63bc6f9f41c15781508481
humanhash: bacon-mars-juliet-magnesium
File name:PO C10090.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:270'482 bytes
First seen:2020-05-23 11:18:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:gGS0P/Q4MJK0NhHhZzvqtVhxz3W92lYsgNKtLqvKIS:RnQ4eh7SRxjWYl6S2vo
TLSH 0C442387F30EE31AE348D3057C6B74CEC38ADE21186B326FA455394E780A75B615BB51
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: yisun.co
Sending IP: 111.90.159.196
From: Nicholas Akuku <benicaeasz@gmail.com>
Subject: PO
Attachment: PO C10090.zip (contains "PO C10090.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23627.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 11:35:33 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip fc867430c8efb6bfa3c5c95cc1378607a14d740b5597a69b9a05dd278fc542ed

(this sample)

FormBook

Executable exe 65cd6807556189c85811f11fb91a981749e7d9760e5a72c0845dd6b8ff93a8f9

  
Dropping
MD5 52b9520f67483c03673b18e500cdb728
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65cd6807556189c85811f11fb91a981749e7d9760e5a72c0845dd6b8ff93a8f9

Comments