MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec1f066d313143220eb12abb23af311e4959685d564add3db0cd907c47e40eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec1f066d313143220eb12abb23af311e4959685d564add3db0cd907c47e40eaf
SHA3-384 hash: 9acb458c8d15f10f8520c8da79c4b89d3fa99e10c392b19275daadfcb1cf03082cc6a2120d3d85f2b843760ed9f0b58d
SHA1 hash: f55d20099fd8c9eccdcac193fa416574cf9b7a97
MD5 hash: 72af61b658285b49cfc06ecddcd47b12
humanhash: wolfram-mississippi-tango-moon
File name:New Purchase Order 50,689.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:521'148 bytes
First seen:2020-10-10 06:53:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:YGqUwBC5LPNCeWSEtLcbp8jYf5TqynMMl9Lk7scdHMTCD8XZ0:YGkQBlHWzLT85TB3A715DN
TLSH EFB423C8551B2136849137F3678888F23887FDD06A1E8CD28B8FBDB7367A077845565B
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic313-56.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.185.31
From: Remia Fomitche <fomitcheremia@aol.com>
Reply-To: Remia Fomitche <fomitcheremia@aol.com>
Subject: Re: Purchase Order Details
Attachment: New Purchase Order 50,689.rar (contains "New Purchase Order 50,689$.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec1f066d313143220eb12abb23af311e4959685d564add3db0cd907c47e40eaf/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 23:19:12 UTC
AV detection:
7 of 42 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qpqm3jrgfbsedvrfk5shlzrdzevs2c5kzfn2pnqzwihyr7eb2xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ec1f066d313143220eb12abb23af311e4959685d564add3db0cd907c47e40eaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar ec1f066d313143220eb12abb23af311e4959685d564add3db0cd907c47e40eaf

(this sample)

Formbook

Executable exe 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b

  
Dropping
MD5 12992accec225e9f9698c02a93180bf7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7743197c71f1c9ae348ca9d594840701835941008ea784deef3eec32b3bc734b

Comments