MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b84d7b981b72d8c21de52274e7793bc9b1fb6b3234f0d53e3b1f7e487fab71c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b84d7b981b72d8c21de52274e7793bc9b1fb6b3234f0d53e3b1f7e487fab71c
SHA3-384 hash: 0fd7db445c0aeba40b44aa45d91b634bd080c92088d5640ee32dcb68a9ba78814c9d5a292937017ac022a29dc1258369
SHA1 hash: 107a58f48a1df0acced2733644a9009ecac1994d
MD5 hash: 18c88fb018d28f215a81fc49d08808c3
humanhash: chicken-nineteen-princess-nebraska
File name:NEW RFQ ORDER 8765224.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:261'536 bytes
First seen:2020-08-17 05:27:30 UTC
Last seen:2020-08-17 09:16:41 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:s7YvQXdFnUWK7ZhN4hKmXZ9RFsCgI8PVKlpKetfm0270+q+:s7YvrWK7ZhN4hp9SvCpK8uL0+q+
TLSH 5A4423B6B1D0255DA01F8300D3DA3B4E7F20489ED0166F6B7D6E56FA322E3DAE6C0552
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email
From: Emma Kimi<sales@kokocarpet.com>
Received: from kokocarpet.com (unknown [212.83.46.93])
Date: 17 Aug 2020 01:53:52 -0700
Subject: NEW ORDER INQUIRY
Attachment: NEW RFQ ORDER 8765224.zip

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b84d7b981b72d8c21de52274e7793bc9b1fb6b3234f0d53e3b1f7e487fab71c/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 05:29:04 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=locnpombw4wyyio6kitu454txsnr7nvtenhq2u7dwh36jb72w4oa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b84d7b981b72d8c21de52274e7793bc9b1fb6b3234f0d53e3b1f7e487fab71c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5b84d7b981b72d8c21de52274e7793bc9b1fb6b3234f0d53e3b1f7e487fab71c

(this sample)

Formbook

Executable exe 0e7ba6c8acc0e3de5a31e050eb287daba683c992e12c4715730ef3ccf3bbf575

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0e7ba6c8acc0e3de5a31e050eb287daba683c992e12c4715730ef3ccf3bbf575
  
Dropping
Formbook

Comments