MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d368eb7c68f98311a76b468468f293a35932b9e895f0f8d52132c54062b21a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d368eb7c68f98311a76b468468f293a35932b9e895f0f8d52132c54062b21a5
SHA3-384 hash: 2eab5131080c5c6e131ceb7f35cc7b35db0228793ae62ab8e348002294331b3c79c54ebebc555b147e78eb757a848e6d
SHA1 hash: 41babbb1a08517ee34241b2be2057b5df5f0ca3a
MD5 hash: d0e47554ca0b3b85b84b4e8b750ac826
humanhash: king-jig-five-mockingbird
File name:Quote19.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:556'925 bytes
First seen:2020-08-19 14:10:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:yKhG6cv/6mC+OuHVS/HT7h/jSa0DkNGzVl:d068pCuejGDLl
TLSH 26C4237AFAB3C4F8D43072BCD6AF5EDB8138650DD5123A095B250B46B93D448978738E
Reporter abuse_ch
Tags:Endurance FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: Helen He < server@hinet.net>
Subject: Reminder for Quotation
Attachment: Quote19.zip (contains "uXRBZswCa6Zf400.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d368eb7c68f98311a76b468468f293a35932b9e895f0f8d52132c54062b21a5/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 14:12:08 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tu3i5n6gr6mdcgtwwruendzjhi2zgk46rfpq7dkscmwfibrlegsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9d368eb7c68f98311a76b468468f293a35932b9e895f0f8d52132c54062b21a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 9d368eb7c68f98311a76b468468f293a35932b9e895f0f8d52132c54062b21a5

(this sample)

Formbook

Executable exe 420c2572fe66b34a3e994b43ec3d35a60559c2b011c02c038854a99034a9ca2f

  
Dropping
MD5 c0ddaf8aa86de1fb9cfb2ee32f6401b7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 420c2572fe66b34a3e994b43ec3d35a60559c2b011c02c038854a99034a9ca2f

Comments