MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1083dcbde85fd9e82998c272994b31000c7596f47d85eea7defca6c5ce73ef80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1083dcbde85fd9e82998c272994b31000c7596f47d85eea7defca6c5ce73ef80
SHA3-384 hash: 301709e948efd0fbf0d8afbb159b005a5b6eb96fecd65d65984187a9bbfc34fea0c5f15215db71f2641dcc4111f12a4e
SHA1 hash: b6cb05b16f739591ba35f2db5c0af221d07edb2d
MD5 hash: 1bc7ea740acf39be33bed3b02d24dba0
humanhash: lactose-twelve-oxygen-moon
File name:Quotation Request RFQ20202804-1 Samples Specs 1.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-30 12:47:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:VBSHZNHBSMCg4u+1LI5aqsnDb6gGGXYuuNbfJnMeM:noPH8s9+1M5SnPIsYu2JnR
TLSH 684512137D5590A1EFAC593180F30B489BF80B93AC07E71F3B9C6A4917A9FD512938B8
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.farolexshippings.com
Sending IP: 185.70.107.220
From: WIN TECH TRADING (HK) LTD<sales@wintechtrading.com>
Subject: Quotation Request // RFQ20202804-1 // Samples & Specs Attached
Attachment: Quotation Request RFQ20202804-1 Samples Specs 1.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 13:35:50 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ccb5zppil7m6qkmyyjzjsszraaghlfxupwc65j667stmlttt56aa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img 1083dcbde85fd9e82998c272994b31000c7596f47d85eea7defca6c5ce73ef80

(this sample)

FormBook

Executable exe d6e2c72145fa1473a21537eb00dfd5f038d441c4852ba54a70234e29cc189e49

  
Dropping
MD5 ef3df5b38646b99b34b123edb3216ab2
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d6e2c72145fa1473a21537eb00dfd5f038d441c4852ba54a70234e29cc189e49

Comments