MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 010de9f40ba9cd0d32fb9f88a938e15bc06a2a25d6c6d22686e8fd2aefc6b930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 010de9f40ba9cd0d32fb9f88a938e15bc06a2a25d6c6d22686e8fd2aefc6b930
SHA3-384 hash: d0b0430da2fbdcbf1ff2c63829f6b46fbcf8e0253d3cf489b64b445dbf015e9778a81422c14d16ee96fd9cc1429fa72f
SHA1 hash: 195cfde82a2e2405ce151dabe30edba49f479849
MD5 hash: ef3781bc37904920c10ae623662caf9e
humanhash: kitten-william-failed-bluebird
File name:200048837.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:419'806 bytes
First seen:2020-07-03 06:41:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:wB6X5UB2IdFIqQqfBKlKInVCMr8bPHhSQA3k2SGPU9XI:qB3Uq1sZS5SQA3kePUNI
TLSH 899423D86F27253EC1307672FA88192F666CC07CBF56678B4415BB1990D83C0BC6F8A6
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.camposreyeros.com
Sending IP: 34.227.147.31
From: ventas <ventas2@visualpraise.mx>
Reply-To: Ventas <fayza.hmidi.artlab@gmail.com>
Subject: Pago
Attachment: 200048837.zip (contains "R44310679.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.31846.3427.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/010de9f40ba9cd0d32fb9f88a938e15bc06a2a25d6c6d22686e8fd2aefc6b930/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-02 20:31:42 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aeg6t5alvhgq2mx3t6eksohblpagukrf23dnejug5d6sv36gxeya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 010de9f40ba9cd0d32fb9f88a938e15bc06a2a25d6c6d22686e8fd2aefc6b930

(this sample)

FormBook

Executable exe 98090f606cda48999384c614b1f92bb9d0e5f1541b86d8d62bf1e6639633a271

  
Dropping
MD5 2a96b9eb377cad03c249a899af9acd16
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98090f606cda48999384c614b1f92bb9d0e5f1541b86d8d62bf1e6639633a271

Comments