MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 737ef8d91d9e7668dac391b471ca3be90c44e0ca0e7946354e3106041c5c9e7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 737ef8d91d9e7668dac391b471ca3be90c44e0ca0e7946354e3106041c5c9e7a
SHA3-384 hash: 17bf6e2b131ff5214b685dffc4aca53473a968724a93052def47c1c4fc9edfa81459d52e5e7aa1869ae2d416baadc25f
SHA1 hash: 940a3f2fecac4f04230c3f103264688f6eeeca0d
MD5 hash: a605c34b633d11fab27207d6d57e752d
humanhash: pluto-golf-iowa-tango
File name:Quotation for Africa.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-19 14:32:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:4RQqt4lVs2Xftpe7OfYe21yAhRo6IuFfVGwfOd0kt3Wak34h319ce0873AyHFoOV:nxHuwAgUfVWdfxWakoxceVTh6l4Z
TLSH 7045CFA2F25455A4E82A35F9903298121173AD2A931A955E30FD333E07BB313CD7BE5F
Reporter abuse_ch
Tags:FormBook Hostwinds iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-764665.hostwindsdns.com
Sending IP: 104.168.236.169
From: info@alqariab.store
Subject: Request for quotation
Attachment: Quotation for Africa.iso (contains "5PTXM4x7ySyoOy6.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/737ef8d91d9e7668dac391b471ca3be90c44e0ca0e7946354e3106041c5c9e7a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 14:34:07 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=on7prwi5tz3grwwdsg2hdsr35egejygkbz4umnkogedaihc4tz5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/737ef8d91d9e7668dac391b471ca3be90c44e0ca0e7946354e3106041c5c9e7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso 737ef8d91d9e7668dac391b471ca3be90c44e0ca0e7946354e3106041c5c9e7a

(this sample)

FormBook

Executable exe 48759dee612da5c1b36dfe7ce569a64c3e6528210ca830993cba1996db55ea87

  
Dropping
MD5 085e1f70a394db623f2248f082837428
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 48759dee612da5c1b36dfe7ce569a64c3e6528210ca830993cba1996db55ea87

Comments