MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac27f9406e43128e85c0ea0b392acf1f6e400791bb7e9acf3bb45c8d0404e49b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac27f9406e43128e85c0ea0b392acf1f6e400791bb7e9acf3bb45c8d0404e49b
SHA3-384 hash: 867d9877ac004469ce1589d9a460f7c3062ff2d172b2e815f11982f9a20d08a1f3b881dc5ebf4a69c39a7557bd2b0f1a
SHA1 hash: 6b29706e4cf619ad4dcfee1a059e6c57513e749f
MD5 hash: d9d9cd9f4cba73b4482b9444ab9afa3a
humanhash: march-island-cola-carolina
File name:payment confirmation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:170'455 bytes
First seen:2020-05-21 10:40:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:QKqsdoniPPS/jTZoCCja9ZhhkMXzpZfD+6qc3NHLEews7qagrJqdBgM48GN:LdoniPPo0G9d+Nc3VEewsOarTy
TLSH 55F312CC2E5A56B7113E6E70B335AEB837153B61A341D888BF8633E614A3CD315B16A4
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: eca-relay.eastcoast.co.za
Sending IP: 196.2.164.97
From: X IT Support <karen.roberts@law.co.za>
Subject: Notification for redacted@threatwave.com
Attachment: payment confirmation.rar (contains "payment confirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 11:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 47 (42.55%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar ac27f9406e43128e85c0ea0b392acf1f6e400791bb7e9acf3bb45c8d0404e49b

(this sample)

Formbook

Executable exe da2d2589cd850fcfcd691a3da7b40a8c47857fbe3e9b6fbf762f3e2095188c7b

  
Dropping
MD5 613e60828fdf6afd043da5afefc451a2
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 da2d2589cd850fcfcd691a3da7b40a8c47857fbe3e9b6fbf762f3e2095188c7b

Comments