MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7987f82ea939a4a41c4d99a49a82ff2ccb1256dc8b8923e7a9860ff1739807ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7987f82ea939a4a41c4d99a49a82ff2ccb1256dc8b8923e7a9860ff1739807ae
SHA3-384 hash: a136808f23cd27713b95861b0e0b72478e3aac3602350473e6f586688d3f3b950480ce7f9e48ddc1f4cc1e4d64b71b29
SHA1 hash: 7e332721f3fb4da43a9c856f23de882c0aa1b3af
MD5 hash: 394bf88161f5d558fe2fa18606ee43b4
humanhash: red-oregon-muppet-moon
File name:Purchase Order 202005.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:468'992 bytes
First seen:2020-05-26 11:09:23 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:qCx9dY0XSYSiT9sdYG3iLIhFhStNXDAGA3p:qm9dY8+iT6P
TLSH 86A45A5B3250F19FC417C97E89583C20AE616CE6531BC203B01B3EAD5A3D69EBF1D5A2
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: farshik.com
Sending IP: 94.100.28.181
From: Emdy oit <smtpf0x-hw4rl@farshik.com>
Reply-To: smtpf0x-hw4rl@farshik.com
Subject: Order delay
Attachment: Purchase Order 202005.iso (contains "Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 12:55:50 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
16 of 31 (51.61%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

iso 7987f82ea939a4a41c4d99a49a82ff2ccb1256dc8b8923e7a9860ff1739807ae

(this sample)

FormBook

Executable exe bd7c17b39ab5f775700bae65b0930ae6b18e674036b6939c7264a9e7f14637ad

  
Dropping
MD5 1d3d99898d0fd21c0db2e7c705480b72
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bd7c17b39ab5f775700bae65b0930ae6b18e674036b6939c7264a9e7f14637ad

Comments