MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5cfaf7aa6cfa64f50d91f70efbd7e6c0ee70c9b2cf8a7f4098cbee5b16ef33a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5cfaf7aa6cfa64f50d91f70efbd7e6c0ee70c9b2cf8a7f4098cbee5b16ef33a
SHA3-384 hash: c857b44a5be4e3088b95bdbde9d1023d7648362671f7a843b8407030efad955588d02063277eb1dbebcae4b08d6435f7
SHA1 hash: ba01a360e51d5acf2993d604363c1a60a3b0f76b
MD5 hash: 460d45776e25947e44175da5c2b210f7
humanhash: kansas-oranges-wolfram-six
File name:850231.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:265'417 bytes
First seen:2020-06-08 06:53:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:/F40KSzSh7OWuDA5vGqiQJOPJiWpcq6G3rAUON7Rlb+xp77:/F40zzsfuDA5vJvwRir9IArE1
TLSH C544235FEC96BECD7A6477168604CFA7AB7D63FC6C0014A3AB8347392538E943DA5201
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: box.mytek-cg.info
Sending IP: 192.236.194.98
From: accounts@mytek-cg.info
Subject: BankCopy Invoices TAS1836709
Attachment: 850231.zip (contains "850231.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:55:04 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6xh266vgz6te6ugzd5yo7pl6nqhoode3ft4kp5ajrs7olmlo6m5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip f5cfaf7aa6cfa64f50d91f70efbd7e6c0ee70c9b2cf8a7f4098cbee5b16ef33a

(this sample)

FormBook

Executable exe 915f6138fa526b0998b85544881e698dcce37994e528c487c15c8acc2762f678

  
Dropping
MD5 94c683e44e09d37b9fec928d93506763
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 915f6138fa526b0998b85544881e698dcce37994e528c487c15c8acc2762f678

Comments