MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24546e95dfa76f69d5bfd98966b5251a3e72dfd0c5970f8d56732965882a5cd9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24546e95dfa76f69d5bfd98966b5251a3e72dfd0c5970f8d56732965882a5cd9
SHA3-384 hash: 658f02579e344f0d5f7eac3c1e43ad40987777d8d31c5c578ad9ef6b9eda595cc48b923abb6ac408510ca7d37c6f4bcb
SHA1 hash: bb1e556583fd1d635b7ae7cc30ef37a6262d8b29
MD5 hash: 3f9f07fd57b75f552500eebb5af424c9
humanhash: william-summer-moon-foxtrot
File name:Payment slip.r11.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:264'569 bytes
First seen:2020-05-13 11:13:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:LPFfIoHsZ8E2+PoQNGDG+CekRkR5W87igaP8q2mrn96h9FY:RfIas2BQofGBePfDkTKTY
TLSH 854423F312AF0F2A1F514343396E4B5097249B399CD5C361F6A029924A6C7BE7B00F78
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: WIN-U3CEMJQKXF4
Sending IP: 180.214.238.108
From: Miss. Kirsty Townsend <kirstytownsendinfo@gmail.com>
Subject: Payment slip
Attachment: Payment slip.r11.zip (contains "Payment slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21665.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 11:36:53 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=erkg5fo7u5xwtvn73gewnnjfdi7hfx6qywlq7dkwomuwlcbkltmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 24546e95dfa76f69d5bfd98966b5251a3e72dfd0c5970f8d56732965882a5cd9

(this sample)

FormBook

Executable exe de55a1b3e711c74c00998d9c4cb0f5da9672b109e2f362ac55f4a9f4033ffbf7

  
Dropping
MD5 64c6c379cd75124396e81aee54b659b7
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 de55a1b3e711c74c00998d9c4cb0f5da9672b109e2f362ac55f4a9f4033ffbf7

Comments