MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7305735632ac8855b9718500944ccf58e84d2d7cbe15a4c374c4ed1391831266. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7305735632ac8855b9718500944ccf58e84d2d7cbe15a4c374c4ed1391831266
SHA3-384 hash: 8fa1048bea7440abbd92e962aca2cf5de459874371907fe64e3ee860f4194b2b9fdcc6747998c5c36aa7ff6a8f788168
SHA1 hash: 05f0bc9eecd3cc5894961d8287cdc0c9c0a2f762
MD5 hash: e0975781ec13c6a5ae015cafccb6a46d
humanhash: bacon-alanine-east-cola
File name:ypvgscvb.40g.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:269'710 bytes
First seen:2020-05-10 07:43:15 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:CPGsVjADRzSXMdxig3h26pEWiSt4Geh+F0NiyhqYKfIel5gED7jMu:KNVORmXyEAuE4Geh+F8xgIengEDvv
TLSH E04423AE8A201A03D92256C35EEA9ACFBB97F521D73B5C031C9764CD0CD2F171A7E215
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: trinity-global.pw
Sending IP: 173.82.255.125
From: Badrinath Naikwadi <director@trinity-global.pw>
Reply-To: franccmcleather@gmail.com
Subject: Bank slip copy
Attachment: ypvgscvb.40g.gz (contains "ypvgscvb.40g.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Genkryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-10 08:35:49 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=omcxgvrsvseflolrquajitgpldue2ll4xyk2jq3uytwrhemdcjta._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz 7305735632ac8855b9718500944ccf58e84d2d7cbe15a4c374c4ed1391831266

(this sample)

FormBook

Executable exe 8224d188f60fa7c7b60249b82cd7d94336542a8a21a57c9adcb00530e068f818

  
Dropping
MD5 ddb35ca208228d0a5772b9df332ce7bd
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8224d188f60fa7c7b60249b82cd7d94336542a8a21a57c9adcb00530e068f818

Comments