MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a2072afa6448aa5046a646dd942ba530265f992bbc73aef3d1eeac0babdec6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a2072afa6448aa5046a646dd942ba530265f992bbc73aef3d1eeac0babdec6e
SHA3-384 hash: 76c4d6c1bef08431742eb7342f32b775f291a6d320df8f0fa08bd6c93f1c6eafea25cf605ce7b048b6896195fb13a0cf
SHA1 hash: b1774a679820e96992db0fec39a2e1ff1f189991
MD5 hash: a9fabbd0d3b50cee96480787085d9a80
humanhash: florida-beryllium-orange-mirror
File name:SKM20200817.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-17 18:51:54 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:7e97/irpSO7XtjiTOFMWHFyclHRrrxo4Y9hGfSnhXs:7GKpSCtjJFTFyeVrb0hw
TLSH 7A45D09766D14922C93869331121973817F69313A0A7DB25F4BF07A32F03FF92B61AD6
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp2.hiworks.co.kr
Sending IP: 121.254.168.210
From: tanmiao2005@iltop.net <tanmiao2005@iltop.net>
Reply-To: "tanmiao2005@iltop.net" <tanmiao2005@iltop.net>
Subject: RE:Request For Quotation
Attachment: SKM20200817.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a2072afa6448aa5046a646dd942ba530265f992bbc73aef3d1eeac0babdec6e/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 18:53:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=piqhfl5gisfkkbdkmrw5sqv2kmbgl6msxpdtv3z5d3vmbov55rxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a2072afa6448aa5046a646dd942ba530265f992bbc73aef3d1eeac0babdec6e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 7a2072afa6448aa5046a646dd942ba530265f992bbc73aef3d1eeac0babdec6e

(this sample)

Formbook

Executable exe 344d949f94b4420c0cd7772fa786e17059d5599df223a93ef999ea2c663ad8be

  
Dropping
MD5 739b5c9945aa1a18d824df02f98e4108
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 344d949f94b4420c0cd7772fa786e17059d5599df223a93ef999ea2c663ad8be

Comments