MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef32b01ab91f30c34ec086b694d1fd6e51fec6dd42f41338843c003817aa77d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef32b01ab91f30c34ec086b694d1fd6e51fec6dd42f41338843c003817aa77d8
SHA3-384 hash: ceab41e15fef1480d3ff53d10b44c04baf93cd10c8c456fe99a0e04a094a373a04f703e27bc47d360fef9a67b92cb71e
SHA1 hash: 64d65cb39caaac905a65f0b3743d743125c6d8d6
MD5 hash: 19c4ff82ae84a41f2cf5f8da48e88742
humanhash: carpet-item-cold-montana
File name:Order.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:230'514 bytes
First seen:2020-05-20 08:46:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:DpkrAVDsHE9UF0Gly2hXBKcB8TeReYh/Fuke:mAVDsHVF0GMMKcB8TYeu/Fze
TLSH FB341263BBFD0C85D5A3A679EF4B9A13BE73D426D5F4AA424FE39105432811D2AE0334
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: solyman.ml
Sending IP: 104.168.175.239
From: Mohammad Hijazi <sales@steelpipespe.co.za>
Subject: Purchase Order100502020
Attachment: Order.rar (contains "Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 09:36:20 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 30 (60.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=54zlagvzd4ymgtwaq23jjup5nzi75rw5il2bgoeehqadqf5ko7ma._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar ef32b01ab91f30c34ec086b694d1fd6e51fec6dd42f41338843c003817aa77d8

(this sample)

FormBook

Executable exe 9caec0c38913b9f2b16161ea88489a600de3eb402192b91d09cf8b692719c4cd

  
Dropping
MD5 6a7f959a58826cda1edf81e298190b06
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9caec0c38913b9f2b16161ea88489a600de3eb402192b91d09cf8b692719c4cd

Comments