MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfbf6f08bca1756a691c01a0881e2294341239bfb26d7a3a9e539f07f0d6d649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfbf6f08bca1756a691c01a0881e2294341239bfb26d7a3a9e539f07f0d6d649
SHA3-384 hash: fea584e48e4512b6cd4e16408945b7b3afd480c9e6ee328041338e4b2d8b306f6c1814b0ca67ab838481cfbd67b9a5d7
SHA1 hash: 7a0125c990177de2b72de2c92ce407d1c4a09335
MD5 hash: 8884dcd7584f1a1a2ffdad68e8c98f12
humanhash: angel-white-enemy-vermont
File name:NEW ORDER #678987657J.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:262'598 bytes
First seen:2020-08-18 05:27:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:QykKNXdFFUWKzkGJoPlbLLykfV/O30dvrURhC9t1AN:WWKzkGqlbLOuO3MUT0AN
TLSH C44423E3CC80A19BD4DC018ECAD54E86587A994FC86BAF14F879225203BCF3749D4E76
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email
From: Sales<sales06@tgybio.com>
Received: from tgybio.com (unknown [62.113.215.235])
Date: 17 Aug 2020 12:24:34 -0700
Subject: LATEST ORDER
Attachment: NEW ORDER #678987657J.zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfbf6f08bca1756a691c01a0881e2294341239bfb26d7a3a9e539f07f0d6d649/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:28:05 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=367w6cf4uf2wu2i4agqiqhrcsq2beon7wjwxuou6kopqp4gw2zeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip dfbf6f08bca1756a691c01a0881e2294341239bfb26d7a3a9e539f07f0d6d649

(this sample)

Formbook

Executable exe bf860192609c621a3b073d826266676c8d942db2a9c6e375a9e386c500b55c7f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bf860192609c621a3b073d826266676c8d942db2a9c6e375a9e386c500b55c7f
  
Dropping
Formbook

Comments