MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85884d31297f4594de54382ac0cf7183371879426902482421f3a5c389163cd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85884d31297f4594de54382ac0cf7183371879426902482421f3a5c389163cd4
SHA3-384 hash: 22316fe9a7d99c85d339074667ea2b482152b530e947554b9d8d1c57ccc62b5a6ce48d485ed2013e92f6044c72629c1c
SHA1 hash: 76c115d01765a54567198b8eb499703d52a50bd3
MD5 hash: 99991f5d2134af4473d0259fad27abd5
humanhash: winner-ink-beer-seventeen
File name:NCB07092020.pdf.jpg.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-09-07 14:19:32 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 1536:/6itnCQ86x7dFktUgLkQtkjsMnVGQ4JE7eADdvlid74PpQL9pbIUf:uEfkSgLztQFREE7eARvlid0PpQLXb
TLSH 33451790E5808521F9BA5639423199907BB27DD63DF1AD0EBACCB2133BF26C31852D5F
Reporter cocaman
Tags:FormBook img


Avatar
cocaman
Malicious email
From: "Paytec GMBH " <infos@aos-stahl.de>
Received: from karik.com (unknown [103.225.25.34])
Date: Mon, 07 Sep 2020 05:22:36 -0700
Subject: Betaling
Attachment: NCB07092020.pdf.jpg.img

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FileRepMalware.7776.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85884d31297f4594de54382ac0cf7183371879426902482421f3a5c389163cd4/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-09-07 09:12:32 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qwee2mjjp5czjxsuhavmbt3rqm3rq6kcnebeqjbb6os4hciwhtka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85884d31297f4594de54382ac0cf7183371879426902482421f3a5c389163cd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 85884d31297f4594de54382ac0cf7183371879426902482421f3a5c389163cd4

(this sample)

Formbook

Executable exe 5edcb867ea82f70e5c2c8fcf09239b0b5f1f9d7305c6715db9c5f428b47d940f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5edcb867ea82f70e5c2c8fcf09239b0b5f1f9d7305c6715db9c5f428b47d940f

Comments