MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cf1251810f225bb5c01e1a5d114a0aed5c81ab16b8957cc194ead5d001beb6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cf1251810f225bb5c01e1a5d114a0aed5c81ab16b8957cc194ead5d001beb6f
SHA3-384 hash: 0f65795e4f1381a99b2d235efcbf9404a11332abcd7b7aaca6c24f6b3bd438542fc7d66f72d1998ce6b786e8ab9944b4
SHA1 hash: cde2d2b29946a9d19a7435824b4854c02cb13a4e
MD5 hash: 8b340b3e44e2e8ad2218d4e94955fc16
humanhash: eighteen-spring-south-east
File name:RQ068364.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:380'436 bytes
First seen:2020-06-11 06:10:35 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:MaDwNfTml2y/v0ZPQdoDui8IBWuIrFeomPbWuS9lnm5iI9gIfWud73bLbyt6IDO8:MasTm+58SWuINmP6u0lnHIiuVLubDd
TLSH 928423CE87C8FB92F4B13DC1A4749E531CE5E65E9A10695AB01E7B52CDB0A38235FC06
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mm0.mmmpics.com
Sending IP: 86.105.1.121
From: Kelly <info@abiexport.icu>
Reply-To: Kelly <Jack.Zou_pluckmarine@outlook.com>
Subject: Urgent Inquiry // Purcase order
Attachment: RQ068364.gz (contains "RQ068364.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ArtemisD45570FD8DFA.15379.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:12:11 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtyskgaq6is3wxab4gs5cffav3k4qgvrnoevptazj2wv2aa35nxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 8cf1251810f225bb5c01e1a5d114a0aed5c81ab16b8957cc194ead5d001beb6f

(this sample)

FormBook

Executable exe fca57bc3188f4383efe5bfd8a6c0e3058273c7dca96ef9360f6290790f8883b6

  
Dropping
MD5 d45570fd8dfaa4bf6b91d83455191c69
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fca57bc3188f4383efe5bfd8a6c0e3058273c7dca96ef9360f6290790f8883b6

Comments