MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 564cf035463b7a4ddcb4bb4821ff47742e9fcd7e0764503b4fbeb87242c22fbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 564cf035463b7a4ddcb4bb4821ff47742e9fcd7e0764503b4fbeb87242c22fbf
SHA3-384 hash: d9f0650505a8277674a445fd73576fe74458a6f6718e3c0c16963b2c4d0400f8aa46e58e6ee9daa10afc1507356c2db9
SHA1 hash: ccfc606f8de4539afc2c400100fe2cb6f3acd0a2
MD5 hash: 1d2adad8e2b1e050e58634ee5147a684
humanhash: muppet-lamp-artist-comet
File name:STATEMENT OF ACCOUNTS.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:392'872 bytes
First seen:2020-05-05 07:12:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+Lp5+41IwikWmSMBrOemlr0KtGnSlsQ59jMdr/HMceRQ2hYKf6Le4WOrxAcdLX0q:K5+zwJWdAq1btHmQn4h/Hd4hYfL44SaN
TLSH E884235DBEF71AF1CB74FEAAB2CC9FCE6993543929C8660058074DD534A0178325CB88
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: box.amanilove.online
Sending IP: 139.59.75.180
From: ACCOUNT PAYABLE <office@contructi.xyz>
Reply-To: office@contructi.xyz
Subject: UPDATED STATEMENT OF ACCOUNT 02.05.20
Attachment: STATEMENT OF ACCOUNTS.zip (contains "STATEMENT OF ACCOUNTS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.44385.23697.15463.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 07:35:48 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzgpankghn5e3xfuxnecd72hoqxj7tl6a5sfao2px24heqwcf67q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 564cf035463b7a4ddcb4bb4821ff47742e9fcd7e0764503b4fbeb87242c22fbf

(this sample)

FormBook

Executable exe c1b2a36d08dfb9bc18d53112299e6cef0c5057885918a4485b8f1b87a20d709a

  
Dropping
MD5 bbb834f13790a853aafd0d0adab527f4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c1b2a36d08dfb9bc18d53112299e6cef0c5057885918a4485b8f1b87a20d709a

Comments