MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82fc4d8acaab0b45e49286d0e5ccdd98c4dcb4d79c56ed3b94691a6270e3dfeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82fc4d8acaab0b45e49286d0e5ccdd98c4dcb4d79c56ed3b94691a6270e3dfeb
SHA3-384 hash: a91429c9c0db95612ddb7ac8599bb82482ba06116834346c267cb2602411d6775f2eac1742e0fab1eb7985cd35567e03
SHA1 hash: 3a0df1c56261023a56c06b96f9db86f361a48d8f
MD5 hash: 94f88c08094c0b9e2606e796de4cfb49
humanhash: music-four-island-carpet
File name:BLS20080024.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:618'635 bytes
First seen:2020-07-20 07:43:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Eg6gogpsveXp8wAwxqqLtPMrNeGpVOSRZlCE6csJR3tda2FiEEH1bVG0A7:Eg6goTeZ8wdxqq5Me8V5RZkE6csztda0
TLSH ECD433F89A35339136C8995E62210C554E9229FCB35423FB17E06F3DB4599B02D3EEB8
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dlveltex.co
Sending IP: 111.90.145.49
From: Duangkamol <allwin@hibox.hinet.net>
Reply-To: allwin@hibox.hinet.net
Subject: REQUEST FOR QUOTATION.
Attachment: BLS20080024.rar (contains "BLS20080024.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82fc4d8acaab0b45e49286d0e5ccdd98c4dcb4d79c56ed3b94691a6270e3dfeb/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 07:45:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ql6e3cwkvmfulzesq3ioltg5tdcnzngxtrlo2o4unenge4hd37vq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82fc4d8acaab0b45e49286d0e5ccdd98c4dcb4d79c56ed3b94691a6270e3dfeb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 82fc4d8acaab0b45e49286d0e5ccdd98c4dcb4d79c56ed3b94691a6270e3dfeb

(this sample)

FormBook

Executable exe 361b870ce5f03b00cd0bd8b38c126a247cedddac310047ecd9fcbab921022de9

  
Dropping
MD5 a409ed59cf9c1e82d1eb0c57cae8f62a
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 361b870ce5f03b00cd0bd8b38c126a247cedddac310047ecd9fcbab921022de9

Comments