MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aac0454c65f31df7b93e2059f4c6895f4fd5fb5c90c6465d45626c391efd864. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aac0454c65f31df7b93e2059f4c6895f4fd5fb5c90c6465d45626c391efd864
SHA3-384 hash: f82fccb0a2e66ab68570ca8fe7caf525918a4cf4be21feef38a87b715a44048d509b9b7d0e4902f83bd680e46bc4935a
SHA1 hash: dd5567d50fdaee01bef499ed4d6496d8c0e0e75d
MD5 hash: 7dda7b7a622537fa7838564b3a3d3c91
humanhash: monkey-carolina-coffee-orange
File name:Anekgroup Order.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:467'401 bytes
First seen:2020-08-19 07:25:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:lrQ5ET/JVHglW89bv1UGL1qMx328r0W9jZmD:lrXT/JVAlW8971N6YZmD
TLSH 6AA4231FD74A8DD8386673DDBE51A2306F16C4317583C398A578E690F92CBF464388E9
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.abusix.invalid
Sending IP: 156.96.59.30
From: Anek Group <naqib@anekgroup.com>
Subject: Delivery Notification
Attachment: Anekgroup Order.zip (contains "Anekgroup Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.26521.6520.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aac0454c65f31df7b93e2059f4c6895f4fd5fb5c90c6465d45626c391efd864/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 17:32:13 UTC
AV detection:
27 of 46 (58.70%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkwaivggl4y5664t4icz6tdisx2p2x5vzeggizoukytmhepp3bsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1aac0454c65f31df7b93e2059f4c6895f4fd5fb5c90c6465d45626c391efd864

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 1aac0454c65f31df7b93e2059f4c6895f4fd5fb5c90c6465d45626c391efd864

(this sample)

FormBook

Executable exe f9105883e8b27ee7cfbe161616f341841f2b7e8c36f5d2b11796e0b002d86ad8

  
Dropping
MD5 20ab5fd8a0b7cf071121621eb19c15be
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9105883e8b27ee7cfbe161616f341841f2b7e8c36f5d2b11796e0b002d86ad8

Comments