MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 902226d7c2bad9966ad0d89b393722f65717bd2204e5879433e3f01afd84a1c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 902226d7c2bad9966ad0d89b393722f65717bd2204e5879433e3f01afd84a1c5
SHA3-384 hash: d7c99ae60a089c758d744ef329d0c7a562d74cb01aab36a1391d3179da9b299528f952be452cbeda53a8a0327bd31353
SHA1 hash: acf0e0c39c3b5abeadbca099c88129c36e03b1a7
MD5 hash: 3819741bc7db473540cbd3c1a1acc65b
humanhash: lactose-cat-crazy-coffee
File name:RQ09872.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:372'940 bytes
First seen:2020-06-11 06:13:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:rqUyeVflU/dvOnxn4dS5FhEQb4Qrb+lj1oJmozS8wuUh177oJKzmzwnvcEvUsRLI:QeewUS54Qb4FBmmozDwu0HgKqEnvcPsG
TLSH B084230D9296871A9CEB5A45C0D342A49782B2A20660F809526CDBEDFD3FC4FEB75643
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mm0.mmmpics.com
Sending IP: 86.105.1.121
From: wendy <info@abiexport.icu>
Reply-To: wendy <Jack.Zou_pluckmarine@outlook.com>
Subject: Purchase Order for June
Attachment: RQ09872.gz (contains "RQ09872.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EMGD.6336.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:15:10 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sarcnv6cxlmzm2wq3cntsnzc6zlrppjcatsypfbt4pybv7meuhcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 902226d7c2bad9966ad0d89b393722f65717bd2204e5879433e3f01afd84a1c5

(this sample)

FormBook

Executable exe 50e9f1e4d84a3a4a4a7487fcd1854b7a9b985a8a87693f51942d1ec3e5a21afe

  
Dropping
MD5 8db0310217ffd20ca739b56a3c194807
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50e9f1e4d84a3a4a4a7487fcd1854b7a9b985a8a87693f51942d1ec3e5a21afe

Comments