MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41a1e296260c1161f592671a62a2fa04bc6a579d2810f52e6d800a9d43bb71a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41a1e296260c1161f592671a62a2fa04bc6a579d2810f52e6d800a9d43bb71a8
SHA3-384 hash: 70dc3b8bcbeb4411533dbfb6f42a7c2b2bc62be1ad4dcc5e74e5ac8ed023aa4d1e182bfbacdebb4e407beb20c4ba0f45
SHA1 hash: f4d72945c2533445695da97d18bdfc36f9c7fe22
MD5 hash: bdc413a66658c49fbd18f4bdb7d19d27
humanhash: solar-ceiling-zulu-hawaii
File name:Company Details.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:233'068 bytes
First seen:2020-06-16 05:22:14 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 6144:6FNLlJBqma4HyMMsAGo7442L46IleTydE+TMkN7T0G:6FV3MmaYyD4o7gLnIs+dEvkN7TN
TLSH 9F3423F4D3B2BADED251489244304CA38F559FFB10088C47CEAA154BDAAD2DD37B59E8
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 162-241-215-93.unifiedlayer.com
Sending IP: 162.241.215.93
From: Daniel Teoh - Arrow Components Malaysia <danielteoh.malaysia@arrow.com>
Subject: Request for quotation, Order no: QRF10075710
Attachment: Company Details.arj (contains "Company Details.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:24:07 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=igq6ffrgbqiwd5msm4ngfix2as6guv45faipkltnqafj2q53ogua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 41a1e296260c1161f592671a62a2fa04bc6a579d2810f52e6d800a9d43bb71a8

(this sample)

FormBook

Executable exe 533ae007c1c7160fdab228346f97ed79f22b6ad1af22303f556ae4aca66e052c

  
Dropping
MD5 05876a00ce45c7edb5f5029d13f5d263
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 533ae007c1c7160fdab228346f97ed79f22b6ad1af22303f556ae4aca66e052c

Comments