MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aff26754ef23f25c764d89c075e57536fc01b17cf6cde627dbf892783723d5fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aff26754ef23f25c764d89c075e57536fc01b17cf6cde627dbf892783723d5fb
SHA3-384 hash: c8fbb442f62b223c9d4f4c9fddf1f4888d9fdd7648f7fb849095b75f1eb71fdc154f635a597e1b5bbdad458f72d43682
SHA1 hash: 0cb543eedda68dcb65b9df964b3df00e15c8a747
MD5 hash: 00d120938f03c49aa2a87ce02570dc2a
humanhash: aspen-october-skylark-whiskey
File name:wire swift 126,400.iso
Download: download sample
Signature FormBook
Create hunting rule
File size:315'685 bytes
First seen:2020-05-26 09:43:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:3/05xYB5CP6irNKyJVbBL02Hx1/BzhGx849yCh9IXwTjsHKjsJ:sYfC5JVJpPx1pE249yQIXwTjsHhJ
TLSH FA642393F382D1FE365ED1416EB75D127E0673892207C8B2821DC8135F1EC9AC7599AE
Reporter abuse_ch
Tags:FormBook iso


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.haihongsolutions.com
Sending IP: 162.241.215.134
From: Muhammad Mehroz Senior Accountant Payable <info@dawood.com>
Reply-To: muhammad.mehroz@outlook.com
Subject: RE: OUTSTANDING PAYMENT(EXP-008) FOR 26 MAY 2020
Attachment: wire swift 126,400.iso (contains "Stripe.bat")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WBA.12189.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:55 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar aff26754ef23f25c764d89c075e57536fc01b17cf6cde627dbf892783723d5fb

(this sample)

FormBook

Executable exe fec5ae0ee4950c22aa3278fbea92faf21abc081160d32ab3047d03c6409f8829

  
Dropping
MD5 52f40e38350510d0101f33526d6fb0a6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fec5ae0ee4950c22aa3278fbea92faf21abc081160d32ab3047d03c6409f8829

Comments