MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 363bac667587b8344e831ec8b539e66c20a519d6ebbc269df1c700b2bec5893e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 363bac667587b8344e831ec8b539e66c20a519d6ebbc269df1c700b2bec5893e
SHA3-384 hash: 954e83b084b6e8f940aac3588a9c66a1a6f400c4b77701dc644a292103dc5d06d6e1b30dcbcc928ffd148d4b26ca5f6a
SHA1 hash: f8094f46219d3ffe1766426d566c6ea8a801883e
MD5 hash: 2ef6b5fb475bcdd7ee5581a89b31e45e
humanhash: river-butter-oranges-fix
File name:RFQ-May.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:517'389 bytes
First seen:2020-05-04 21:03:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:KkMkNluOOcJWEonqqlhEnENWUzIpGIkWYu6Pr/IOGZlp:KkMkNA5EoVlhSMWU/zu+GZL
TLSH 81B423F8EC1F740D150FF5144B9B29FA8D91E12BA604731E3FA6129DA422FAD1D037A8
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: cathay-food.co
Sending IP: 111.90.140.123
From: Steve Brookes <corporate@canadacomputers.com>
Reply-To: infostemickkrane@gmail.com
Subject: FW: Urgent Inquiry Needed.
Attachment: RFQ-May.zip (contains "RFQ-May.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 04:03:16 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gy52yztvq64ditudd3elkopgnqqkkgow5o6cnhpry4alfpwfre7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 363bac667587b8344e831ec8b539e66c20a519d6ebbc269df1c700b2bec5893e

(this sample)

FormBook

Executable exe 20bb2a2cfbd8ed39ee218be6049140c68c7b2b2ea446caec04106ee0a813f4aa

  
Dropping
MD5 a1645dd82a303a92283d56dcc8f0d764
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 20bb2a2cfbd8ed39ee218be6049140c68c7b2b2ea446caec04106ee0a813f4aa

Comments