MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6af83d4ffe674cb01e254e55da42af643e7c21ed5a85b2342164fea83cadeef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6af83d4ffe674cb01e254e55da42af643e7c21ed5a85b2342164fea83cadeef5
SHA3-384 hash: 11ba03d1b8e24204f60495118abf46d72f3ed7ef57c2bb32562fb7d5ea7d24a0b878b3d0910e59f6b7529f3b08a9f927
SHA1 hash: 29f9287f0a88b640d3f526ee7d825fba69be8dc7
MD5 hash: 13aff805f4ae8457cb1010904e51ca07
humanhash: maryland-kitten-sweet-network
File name:ORDER-8043222VN.z
Download: download sample
Signature FormBook
Create hunting rule
File size:378'654 bytes
First seen:2020-08-12 06:18:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:Fws5fFTBCxhjjWWu4JRri2Q+tZNKZKVoMQvZDvT0IgG5/6VJGlm+iMJb9QfNSnL2:p1FTgF6WusiTSyCuDvv15/MrqmUpvN4j
TLSH 268423D4F1A5419F576DD904A8CC8C3B1A2B252E9337DE8D652C72C0D5BD68F238CAB2
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: manda.com
Sending IP: 45.127.62.185
From: Smarth <mtrebejo@sanpablo.com.pe>
Subject: Request for Quote 8043222
Attachment: ORDER-8043222VN.z (contains "ORDER-8043222VN.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6af83d4ffe674cb01e254e55da42af643e7c21ed5a85b2342164fea83cadeef5/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 06:20:07 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nl4d2t76m5glahrfjzk5uqvpmq7hyipnlkc3enbbmt7kqpfn532q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6af83d4ffe674cb01e254e55da42af643e7c21ed5a85b2342164fea83cadeef5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

z 6af83d4ffe674cb01e254e55da42af643e7c21ed5a85b2342164fea83cadeef5

(this sample)

FormBook

Executable exe be62fe48cc7e28c398424847ed5a73946fe0ae70f2af9980ffc68c57c2103550

  
Dropping
MD5 41373f51b2aaed613b4dd95c3a7fe8b9
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be62fe48cc7e28c398424847ed5a73946fe0ae70f2af9980ffc68c57c2103550

Comments