MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab90e8d997b7a0729539dab0c1f8ad5056d440667dffa77e40656f69ccb4d93a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab90e8d997b7a0729539dab0c1f8ad5056d440667dffa77e40656f69ccb4d93a
SHA3-384 hash: 4c561e7dad0d88d2a8ac09ea1458776b8606dad54e552fe6b0ab5b681a3457fe2e11ecef1e86e377dbac5dc276ca8fb7
SHA1 hash: 5ffc08d4ea6bfb8503861290af540b175ec74dcd
MD5 hash: 571631eb9c3b5a87affdfdfbe7adae58
humanhash: wisconsin-alanine-zulu-red
File name:Product Specification.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:177'735 bytes
First seen:2020-08-13 05:50:26 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:mZdPck9ZlZ2wBlhcJsBU3hjwoZgtS4lqNOOV4dfHYe0Mbu1l+JVT:mZPLvhyLh0ggtX4O04d/SMuli9
TLSH 5D041231471590E3FEA762717F047AD977948D44601EF0C9E6E71E43CA3ADE2A06B748
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: servidor.quoqle.es
Sending IP: 185.37.226.85
From: Twin Crown <sales@twin-crown.com>
Subject: Product Specification
Attachment: Product Specification.rar (contains "Product Specification.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab90e8d997b7a0729539dab0c1f8ad5056d440667dffa77e40656f69ccb4d93a/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 05:52:08 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=voiorwmxw6qhffjz3kymd6fnkblniqdgpx72o7samvxwttfu3e5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ab90e8d997b7a0729539dab0c1f8ad5056d440667dffa77e40656f69ccb4d93a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar ab90e8d997b7a0729539dab0c1f8ad5056d440667dffa77e40656f69ccb4d93a

(this sample)

Formbook

Executable exe 67621e39feff68de7d856d81acb0992540b4af197a94d71c32d9209e8d432a7f

  
Dropping
MD5 efab214511d0cba67acece0e25ec0ed5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 67621e39feff68de7d856d81acb0992540b4af197a94d71c32d9209e8d432a7f

Comments