MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa88dfd4aa3ba54062d18819a564a80480c8201f0f5300982ea91974bdbf67cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa88dfd4aa3ba54062d18819a564a80480c8201f0f5300982ea91974bdbf67cc
SHA3-384 hash: 451eba15352d7b4f6f466e493df8c102b94b5b8ebe9e4935b9dd3d70c4931251a0561b04e61cbb68df4f5fb376ba233e
SHA1 hash: 3e769fcd3007de5c5fdb33e94d2720402c491d15
MD5 hash: 4edea468c52e91c614cf055d47085070
humanhash: high-freddie-princess-fifteen
File name:MPO1005074.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:277'907 bytes
First seen:2020-04-29 18:46:03 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:wmTvKdcPnWd0psp/hlq6pCPRQ2WCyvsKFQeFriu47hvIvk/0ZSRvD7LnrQK:wmzKdcfWESORQ2hKFP9ivpIvkpRvD7jz
TLSH AA442365254379BF8B1740E81FA8AF84742FFB22B45851102F87E2CCF61B1C49FEA925
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 3sapparel.co
Sending IP: 111.90.140.230
From: Carolyn Mulcahy <Carolyn@calibre.com.au>
Reply-To: patbonnantakui@gmail.com
Subject: URGENT INQUIRY.
Attachment: MPO1005074.rar (contains "MPO1005074.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 19:36:03 UTC
File Type:
Binary (Archive)
Extracted files:
49
AV detection:
28 of 48 (58.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vken7vfkhosuaywrram2kzfiasamqia7b5jqbgbovemxjpn7m7ga._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar aa88dfd4aa3ba54062d18819a564a80480c8201f0f5300982ea91974bdbf67cc

(this sample)

FormBook

Executable exe 782999121ca089a150f34c3527a7e1c1a5f9c59a73034e3bf6ca166c590a47f3

  
Dropping
MD5 d0578e0879c72225110c109fdc08ad0f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 782999121ca089a150f34c3527a7e1c1a5f9c59a73034e3bf6ca166c590a47f3

Comments