MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fea591c91f4db5a9238525988d1844cf9d68331b4cf4425acedff0fb9fb9b2d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fea591c91f4db5a9238525988d1844cf9d68331b4cf4425acedff0fb9fb9b2d7
SHA3-384 hash: b8382afcd1d6de1df45ad92e954ddc4e4bd53c538b03930690bc321aa9f6f3f9bee8a2712a16b9376a7eb99ff022a979
SHA1 hash: 86467edf38be38884c655cebf047df352e0d1150
MD5 hash: c6d9b9f4525c166f772f738eb245b5ab
humanhash: fourteen-angel-louisiana-happy
File name:caietul de sarcini.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:672'421 bytes
First seen:2020-09-01 04:48:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:q+vkxizn3HPjnVnHVO0uhfMSGumVNpvrLXCAEZGTBmBpVoK7KmsuTvxAF/8i:q+vac3LVVcfMSwbpvrjHEZe+T7nFTvGJ
TLSH DDE4231FC82FA97FC525101A311BC102D11C3F0BE6AF97D74AAE26B69CD23D225DA157
Reporter abuse_ch
Tags:geo ROU zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Gabriel Ionescu <office@infiintarisocietati.ro>
Subject: Re: Re: caietul de sarcini al comenzii
Attachment: caietul de sarcini.zip (contains "caietul de sarcini.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42555.11407.590.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fea591c91f4db5a9238525988d1844cf9d68331b4cf4425acedff0fb9fb9b2d7/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 09:32:19 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=72szdsi7jw22si4fewmi2gcez6owqmy3jt2eewwo37ypxh5zwllq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fea591c91f4db5a9238525988d1844cf9d68331b4cf4425acedff0fb9fb9b2d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip fea591c91f4db5a9238525988d1844cf9d68331b4cf4425acedff0fb9fb9b2d7

(this sample)

Formbook

Executable exe f4156e15b465020e6687a23a63eb4b7c84a18f90ead4665087c6c2e5a09b455d

  
Dropping
MD5 f28ec13e3098402bc68fea894fd99053
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f4156e15b465020e6687a23a63eb4b7c84a18f90ead4665087c6c2e5a09b455d

Comments