MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0322520b1449a362dd83d025858152ce8f1abd8838b60fdf63e636c8e33ca365. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0322520b1449a362dd83d025858152ce8f1abd8838b60fdf63e636c8e33ca365
SHA3-384 hash: f8c771c29aa93886bb37378159e806340d138f9f7f2ad0c938e56a81a6c7cd5c5cb02fdb72866111f291db9d85163cd3
SHA1 hash: d69fff098b90d5778129cf146d765d86e9e7f89e
MD5 hash: ddcd5b9d0799709a7853b7fb377a7954
humanhash: two-diet-zebra-illinois
File name:order19082020.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:433'915 bytes
First seen:2020-08-19 14:11:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:d6kNZjWf0tXvWSIA94KoQJum2k1aNT3m+e62aEzJz:d6KW8XvWfY4KzJtwNT1fXEl
TLSH E894239EABE9EB60537068C743469CBF465424ECAD0C1E2FAA64403357BE28DB343C5D
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: Albion <info@albion.ca>
Reply-To: Albiongroup@albion.ca
Subject: Also Send PO copy along with Bill
Attachment: order19082020.zip (contains "hMqCrIGQ1xqRpYS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0322520b1449a362dd83d025858152ce8f1abd8838b60fdf63e636c8e33ca365/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 00:36:40 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=amrfecyujgrwfxmd2asylaksz2hrvpmihc3a7x3d4y3mryz4unsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0322520b1449a362dd83d025858152ce8f1abd8838b60fdf63e636c8e33ca365

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 0322520b1449a362dd83d025858152ce8f1abd8838b60fdf63e636c8e33ca365

(this sample)

FormBook

Executable exe 9e31a9eedd25bd1b57d01f6f9f265cf5d13218f3e3e1866128d061ba5c77c452

  
Dropping
MD5 3adecadefc8bdb2a7a28bbbc96c9a9b2
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e31a9eedd25bd1b57d01f6f9f265cf5d13218f3e3e1866128d061ba5c77c452

Comments