MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7b0a0a757187dd571a4d9d89d7f1a8370e2691473b8ceddfad0170c40ff9495. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7b0a0a757187dd571a4d9d89d7f1a8370e2691473b8ceddfad0170c40ff9495
SHA3-384 hash: 7ed275be055c10f7df294acac3c803698e88fc5d7067f64b2ba1e80caa3f980998b5851668f53e952f0b3cc97923d722
SHA1 hash: 8c3ccc6d2b11cf893f12e65b4816a7314ca33e1d
MD5 hash: b37c6fc0417783771acbdee054be2bd6
humanhash: quiet-pip-earth-mobile
File name:Request for Quotation - RFQ.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:509'749 bytes
First seen:2020-06-04 07:11:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:FLpr0dnRcdip4J79yFzBVzVzPNin++ZmhlDesRPnOUm8LL2J9yaiUOfcJCJnuX1r:qGip4J4hBNVTiK7R9vhaiU7QZeeA
TLSH C0B423B4814764DDC91F838E58ACFF0F69125BF2481A807F78AC33535DB185FBA41AA9
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mta-64-161.tll07.zoneas.eu
Sending IP: 217.146.64.161
From: veljo@swecon.ee <veljo@swecon.ee>
Subject: REQUEST FOR QUOTATION
Attachment: Request for Quotation - RFQ.rar (contains "Request for Quotation - RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 07:37:39 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=46ykbj2xdb65k4ne3hmj27y2qnyoe2iuoo4m5xp22alqyqh7sskq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar e7b0a0a757187dd571a4d9d89d7f1a8370e2691473b8ceddfad0170c40ff9495

(this sample)

FormBook

Executable exe 7c2b01523e8d8a1ea6d09a426ad2a8fb88ec84bb9d3d0c42743b86ab16bd54c7

  
Dropping
MD5 77e7444bee5135cbdab1d6ff87e9de99
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c2b01523e8d8a1ea6d09a426ad2a8fb88ec84bb9d3d0c42743b86ab16bd54c7

Comments