MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c58b777f2e1a5ec2cd7428d5ee1b350ca14c233c920bf7b62bcc1139a966dcd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c58b777f2e1a5ec2cd7428d5ee1b350ca14c233c920bf7b62bcc1139a966dcd5
SHA3-384 hash: 2d6121edad0b10746ac545c5bccf638c43f3eb5877d1a35acb2bf1676ed085e3906a9ea5ec1627e6cc48357c3d12d278
SHA1 hash: 68eef8b5fc06c96c86b18d8dbfc89513b8adcdf6
MD5 hash: c22e20b2b2ebc6b5bdfb04c7378677f2
humanhash: video-mexico-colorado-arkansas
File name:ORDER 5.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:256'907 bytes
First seen:2020-05-25 09:19:40 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:N5Lmks/pNq+s0HTt3Qa2ah4gH5YpvbCfnvQ1OPY7rwIlw:N5KnTt3b2ah9PfvQ0
TLSH 9A442387633EEDF0A451DCA50FC2A1E6633B375627CCB59C80D6CD8752798D4293EA42
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Regina Gulf <reginagulf@qualitech-solutions.cam>
Subject: RE: PURCHASE ORDER
Attachment: ORDER 5.rar (contains "ORDER #5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 09:36:15 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c58b777f2e1a5ec2cd7428d5ee1b350ca14c233c920bf7b62bcc1139a966dcd5

(this sample)

Formbook

Executable exe 161ab2a24a2f0a71e1a50d1110b3ca25ec1a53c1412c2235db94a871bc3c9563

  
Dropping
MD5 3cb0b2dcb4a0de3eb26cd30d33928696
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 161ab2a24a2f0a71e1a50d1110b3ca25ec1a53c1412c2235db94a871bc3c9563

Comments