MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 630b47cd56e437134b084f0861510bffe467872d9a3ab16d64676cf076d1c0f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 630b47cd56e437134b084f0861510bffe467872d9a3ab16d64676cf076d1c0f5
SHA3-384 hash: ddcfba1c9b650bb32a2b9b26844cfad8182a2f18f571e60f05aa996c1faefd6dcfa7ade4b69d88136fb577bd3354c909
SHA1 hash: 515b799543cd80a60b9d145ba0430468de59bcca
MD5 hash: 93e0fc8fff18e6a2e9977a3cca1fa9ee
humanhash: lactose-saturn-golf-august
File name:RV OFFER REF 571 - REF. INQUIRY NP17836.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:590'122 bytes
First seen:2020-07-20 09:29:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:6yMuGSSpLqL/8KK+/0FJEtFZdX8BuXdp918d0kk4IqHw2QmSoD/:Uuz6e/81+/4Ji3sBQdRdxYhaoD/
TLSH 21C4234E41C2A176878D247BAAA7D8578847B013770BF20D23CAA8F9745E677D305BC7
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 700rdns3.websouls.net
Sending IP: 116.202.49.147
From: SYED TALHA <sales@npiuae.com>
Reply-To: info@npiuae.com
Subject: RV: OFFER REF: 571 - REF.: INQUIRY NP17836
Attachment: RV OFFER REF 571 - REF. INQUIRY NP17836.zip (contains "RV OFFER REF 571 - REF. INQUIRY NP17836.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.52265.12326.13411.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/630b47cd56e437134b084f0861510bffe467872d9a3ab16d64676cf076d1c0f5/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:31:05 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmfuptkw4q3rgsyij4egcuil77sgpbznti5lc3lem5wpa5wryd2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/630b47cd56e437134b084f0861510bffe467872d9a3ab16d64676cf076d1c0f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 630b47cd56e437134b084f0861510bffe467872d9a3ab16d64676cf076d1c0f5

(this sample)

FormBook

Executable exe 1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a

  
Dropping
MD5 b659d359a6fafaf7954c78199552852e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a

Comments