MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bc47d513146ea22cbc57cf1654e5adbf2b80c17a75bc85d6cd1e7b7c389b2d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8bc47d513146ea22cbc57cf1654e5adbf2b80c17a75bc85d6cd1e7b7c389b2d6
SHA3-384 hash: 082f664bce40849422169b3d694d75e384f2362ad15405cfc43fb767486f853853942b3c80334e00535baf61f5bd51ad
SHA1 hash: b4a25f3f9cba688a91adf65f14fa1ea9cca50d32
MD5 hash: 6f1f6727c40f68d315355dc76532adcc
humanhash: tennis-cold-east-seventeen
File name:Procurement Agreement.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:450'907 bytes
First seen:2020-07-29 14:30:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+piGwYCBEGj/4NVNhTn7oaN5b6v7qHIbfGVO4c6kV:+wxBpr4nXNxe6I7zr
TLSH ADA423FAC621932EF708981172B98F4113067E7CD12630B9AC946BE74F592CEE4A7D5C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.vsysad.com
Sending IP: 139.64.246.182
From: Sales SFG Bilbo <sales@percenna.com>
Subject: DSP Purchase Order No: PO-DSP-20-09736
Attachment: Procurement Agreement.zip (contains "Procurement Agreement.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8bc47d513146ea22cbc57cf1654e5adbf2b80c17a75bc85d6cd1e7b7c389b2d6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 13:33:02 UTC
AV detection:
22 of 48 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rpch2ujri3vcfs6fptywkts23pzlqdaxu5n4qxlm2ht3pq4jwlla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8bc47d513146ea22cbc57cf1654e5adbf2b80c17a75bc85d6cd1e7b7c389b2d6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 8bc47d513146ea22cbc57cf1654e5adbf2b80c17a75bc85d6cd1e7b7c389b2d6

(this sample)

FormBook

Executable exe 0ffe3a2c15dd0469d00b515316cdf09ae0e6b4dbbffe106297cf7f7d0d1b8197

  
Dropping
MD5 5619bf6aed56992a940e39c1902574ff
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0ffe3a2c15dd0469d00b515316cdf09ae0e6b4dbbffe106297cf7f7d0d1b8197

Comments