MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4981456ac3eda0bbaab1c1869d6f5b75840a31638ced3933451f9e3d7fefe80e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4981456ac3eda0bbaab1c1869d6f5b75840a31638ced3933451f9e3d7fefe80e
SHA3-384 hash: ded6b6157559754a13aaa1ed5b16b71400864efaf9cb8457aee6c4f6046e2a3e54e7bac978bf90fca34fd7669cc6e6cd
SHA1 hash: a3f55efc46784f65c499dc40d4009bde0f3e0388
MD5 hash: 4240af4996fe0f111238f292e7358d22
humanhash: spring-magnesium-quiet-mobile
File name:Petrofac.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:356'579 bytes
First seen:2020-08-05 09:08:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:XibKxOhIQnUAuj4/7iJINS6Wmy7Fc9tgZc7vSyRjT37o6qYWJFhaAVLom5b8di1X:0KxTyRuJIbYFkf77Rs6q15BnHNJ
TLSH DF742399D49C8E4C24E0F89CC0E5197C0B4DB969065FE7B95EBF834C1A989BCCC6C963
Reporter abuse_ch
Tags:FormBook Hostwinds zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-759308.hostwindsdns.com
Sending IP: 104.168.213.29
From: Jackelyn Juarez Pita | Gerente Administrativa <info@crio.com>
Reply-To: Jackelyn Juarez Pita | Gerente Administrativa <info@crio.com>
Subject: Petrofac Project
Attachment: Petrofac.zip (contains "fHSx6OpaE6dTxT5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4981456ac3eda0bbaab1c1869d6f5b75840a31638ced3933451f9e3d7fefe80e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:10:08 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jgauk2wd5wqlxkvrygdj2323owcaumldrtwtsm2fd6pd277p5aha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4981456ac3eda0bbaab1c1869d6f5b75840a31638ced3933451f9e3d7fefe80e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 4981456ac3eda0bbaab1c1869d6f5b75840a31638ced3933451f9e3d7fefe80e

(this sample)

FormBook

Executable exe e7a3a92b790205c08f44ddc1dc7fef7e0c44e930e00582b9c21a6ba95a25439c

  
Dropping
MD5 7e3bab347cbbfe69878659d9c55c726e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7a3a92b790205c08f44ddc1dc7fef7e0c44e930e00582b9c21a6ba95a25439c

Comments