MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7
SHA3-384 hash: 87cc99a7ae00b20ca6c6964b411716b11b90830b8566ee6659b780047d31006ed5de46f89685065f276c38bd843472cf
SHA1 hash: 803322b899e2d31a3a717b28d474f27b784e498b
MD5 hash: a05152ab7844320752e3dbedbc8b02be
humanhash: table-winter-juliet-india
File name:Old Payment Information_PDF.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:305'162 bytes
First seen:2020-05-02 12:58:06 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:IOoqXMzKV/bn4tlkjaLGvOzkn0imQLhFa:tP0TkjaLoKkOEa
TLSH 2E54236D7E5C6BF91937530237EE4054AD40A67339121A9872DFCEA38359317C2DD0AE
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.eleasunn.com
Sending IP: 45.95.169.202
From: info@pangaea-hk.com
Subject: UPDATE INFORMATION FOR PAYMENT PURPOSES
Attachment: Old Payment Information_PDF.zip (contains "Old Payment Information_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.13132.27846.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-02 13:35:26 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
20 of 48 (41.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6suwoi4xobyjvqaxjlexttgf35qxfscxotce57v4f3vmpauthtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip afa54b391cbb8384d600ba564bce662efb0b9642bba62277f5e177563c1499e7

(this sample)

FormBook

Executable exe 5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2

  
Dropping
MD5 dce34cf780d56c10d05817c4857d92e5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5eb9ca5476eb4c9c83bbb5d6bbb7ff90474749121e2e063bbd9e988c4e4917e2

Comments