MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02b4d21a4dcfe793027cc1be224d94f5334fff82ac52248a3e44aba68666978d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02b4d21a4dcfe793027cc1be224d94f5334fff82ac52248a3e44aba68666978d
SHA3-384 hash: 821df7df87255abdfccda0e32f444bdbfafff8ef6c41e3a9c5fa79e969bf68b3d3e91a848104b2c4c6160be47d3c7be3
SHA1 hash: 311c177ee8913ead940718182b9f33ada6634dc9
MD5 hash: 12e0e4ff2d88c07589c90c8e2fd5438f
humanhash: mexico-avocado-fruit-mississippi
File name:invoice.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:203'938 bytes
First seen:2020-05-05 07:47:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:oAKCKEUn1cqwU0P6sZSQgf43ULrdVUVdEHWUG4Kb:o7JuLU0P6QSQgf43CV6djUOb
TLSH A3142394E00CABA280F8C347BF16699E55AC38A5FDC7D9783DD4537E8446D8FC86C462
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hosting1.gugocreative.com
Sending IP: 138.201.21.74
From: Archana Ambolkar. <info@beerbhde.com>
Subject: Kindly send us best offer for below items with terms and conditions.
Attachment: invoice.zip (contains "new.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.EPI.17040.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 08:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
27 of 48 (56.25%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ak2negsnz7tzgat4yg7cetmu6uzu774cvrjcjcr6isv2nbtgs6gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 02b4d21a4dcfe793027cc1be224d94f5334fff82ac52248a3e44aba68666978d

(this sample)

FormBook

Executable exe 7527530d28c88ea0850926a24ba050a4a77983fb8271309c749ba43e7b10c695

  
Dropping
MD5 a88e4bd1e3507132fcdd28f38a6751f7
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7527530d28c88ea0850926a24ba050a4a77983fb8271309c749ba43e7b10c695

Comments