MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 648e54ae399b4e5dc63a29dfbe49e301d429a8fb774bbde6e29a7edf6c6b44cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 648e54ae399b4e5dc63a29dfbe49e301d429a8fb774bbde6e29a7edf6c6b44cb
SHA3-384 hash: 1703aa8a7a97b4927b10d7cbf15008fee5a80424da38e7e667bbb7a4b03ed29f40d22c01776b752809754b555d1df216
SHA1 hash: d0a04b609a96d2c94f146697e01bb4871119114d
MD5 hash: 2386a3d8bba61f95fd8815975d090801
humanhash: october-carbon-sixteen-fruit
File name:Bank_details.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:763'366 bytes
First seen:2020-08-05 11:40:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:/3LYscaaBdvW6sFqQGgcM4IrhzHQ2Eqvg7RCs1SHPL+7lQdanvgpQP5cp4q54luG:/3LY5Zq6scgcMdxHQ2XYRCHT+7leavjD
TLSH 3CF433CB8631C48CF6C5B0E8EFF9D48D6E96F5445DF5BA934C6C7E2E9B89D880528404
Reporter abuse_ch
Tags:Endurance FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-205-158.unifiedlayer.com
Sending IP: 162.241.205.158
From: helen <marketing@sreekrishnatextiles.com>
Subject: Re: Bank details
Attachment: Bank_details.rar (contains "Bank_details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/648e54ae399b4e5dc63a29dfbe49e301d429a8fb774bbde6e29a7edf6c6b44cb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:42:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mshfjlrztnhf3rr2fhp34spdahkctkh3o5f33zxctj7n63dlitfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/648e54ae399b4e5dc63a29dfbe49e301d429a8fb774bbde6e29a7edf6c6b44cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 648e54ae399b4e5dc63a29dfbe49e301d429a8fb774bbde6e29a7edf6c6b44cb

(this sample)

Formbook

Executable exe 62e2a294f251c8ecbffa9c5ca2752c24a214e960692c224d716bfc4d168bb087

  
Dropping
MD5 c66fe598bfed79bf6fd006ec99d8e95d
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 62e2a294f251c8ecbffa9c5ca2752c24a214e960692c224d716bfc4d168bb087

Comments