MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3fabed6513a96dd8c464ea886226ef26c257affeb578ea68105ec46b03e938b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3fabed6513a96dd8c464ea886226ef26c257affeb578ea68105ec46b03e938b
SHA3-384 hash: 2c5c5081a313559214b559f7c45c86de550196c86688225abb8ba7a035fe26522cca0b038252a9d65d92e34c99928835
SHA1 hash: 9d584df11e5a430cd738fcc31b8bc26258ee2c68
MD5 hash: 77c51de0baaf075906749bc6a7795cb0
humanhash: bakerloo-berlin-hamper-red
File name:Payment Advice - Advice RefGLV824593835.txt.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:439'432 bytes
First seen:2020-10-15 11:56:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:ezeS7U554r1TlY20UC1U9iHXdJJZ2ZxIqRD6:XS7KKr7Y2T8hNJJZAxNR6
TLSH B1942363587976C74E436481BABB5A1B04A472978C43CE20DFDD31F0580D29B37AAFDA
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: uzlinshpl01.uzcloud.uz
Sending IP: 185.74.4.8
From: Maxsus Kuwabara (桑原和真) <maxsus@crrt.uz>
Subject: Payment copy
Attachment: Payment Advice - Advice RefGLV824593835.txt.gz (contains "Payment Advice - Advice Ref[GLV824593835].exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3fabed6513a96dd8c464ea886226ef26c257affeb578ea68105ec46b03e938b/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 01:46:59 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=up5l5vsrhkln3dcgj2uimito6jwck6x75nly5jubaxwenmb6sofq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a3fabed6513a96dd8c464ea886226ef26c257affeb578ea68105ec46b03e938b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz a3fabed6513a96dd8c464ea886226ef26c257affeb578ea68105ec46b03e938b

(this sample)

Formbook

Executable exe d325c45529e7211242f65cabe3549dd635a23fc43b48c2b2a64ccff8d54c1ee2

  
Dropping
MD5 d5f198c0a67108444c4a4bce112f0eab
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d325c45529e7211242f65cabe3549dd635a23fc43b48c2b2a64ccff8d54c1ee2

Comments