MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36949f40bac224b7f62b6aa61501f2084d1cb286f5b0d0f87ab2fe04566c5ee1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36949f40bac224b7f62b6aa61501f2084d1cb286f5b0d0f87ab2fe04566c5ee1
SHA3-384 hash: 2d5be8c44581c331edfafa159b2be45229e0aee90c87182c1c4d92af19742b988c9d5de33aec665bab7dcf1df062bd33
SHA1 hash: d0b8049777824ffd5a79d314f4da91596686935e
MD5 hash: fe9c53f29dbe5b9d9a13168ecd2fa458
humanhash: music-zulu-arizona-quiet
File name:PI DX190530 final.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:479'487 bytes
First seen:2020-08-17 06:17:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:ZTx9uWVyN3esP8tXXPC7ZSiegLHMdp1mP/6vjQAJWM/:tWWg5esP8tXfCQiegLwu/6b5z/
TLSH 67A423715BB0C5DB8BB1B71B24588FF7448BEE2D53133CA999C877A3A0286054FA974C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: xv20.fiorentinpcp.gq
Sending IP: 104.131.85.246
From: Camilla Bone <sales@fiorentinpcp.gq>
Subject: Order UK PI DX190530
Attachment: PI DX190530 final.zip (contains "PI DX190530.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36949f40bac224b7f62b6aa61501f2084d1cb286f5b0d0f87ab2fe04566c5ee1/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 06:19:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g2kj6qf2yislp5rlnktbkapsbbgrzmug6wynb6d2wl7aivtml3qq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36949f40bac224b7f62b6aa61501f2084d1cb286f5b0d0f87ab2fe04566c5ee1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 36949f40bac224b7f62b6aa61501f2084d1cb286f5b0d0f87ab2fe04566c5ee1

(this sample)

FormBook

Executable exe cf4ee4097cc5954454ca5204a2e12bb7f22890b050fbdbbb8cf467358d36b44b

  
Dropping
MD5 4f8881d1b00225db8b3cc8f89f5ce398
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf4ee4097cc5954454ca5204a2e12bb7f22890b050fbdbbb8cf467358d36b44b

Comments