MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97c8b86636fb4b9c0c95d9c445d89cb712e2776b3e514295a72d11601450709a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97c8b86636fb4b9c0c95d9c445d89cb712e2776b3e514295a72d11601450709a
SHA3-384 hash: 0e6de3130e5c42cd4869f0dd8dfd0f7d40dd508503e419aad9f68cb08de59f5a60fd173d1e2cd349f74bc80acf5474b2
SHA1 hash: f2dfe82b1b53d902811ff84cef9ed9b3f7676ae4
MD5 hash: 4dbe32bf405ac8daa47053f64eac4776
humanhash: nine-delta-glucose-golf
File name:SOA 22072020.7z
Download: download sample
Signature FormBook
Create hunting rule
File size:277'687 bytes
First seen:2020-07-22 07:11:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:oBNRn7E3EMoDQrGKQft62Qv/xPnUPFCkvNqBLgDXR7:ouEZQ1s62Qv/JnK9N8LSXR7
TLSH 2D4422BEB798F4D18641482023E4DAF4EC65BA8BA819AF2593CDD41C5F1C770C01A3EA
Reporter abuse_ch
Tags:7z FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.DSPROMEDIA.COM
Sending IP: 91.151.85.120
From: Fulcrum Maritime Systems Ltd <accounts@fulcrum-maritime.com>
Subject: SIA SHIPPING INC. - Fulcrum Maritime Statement of Account - 22/07/2020
Attachment: SOA 22072020.7z (contains "SOA 22072020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.17636.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97c8b86636fb4b9c0c95d9c445d89cb712e2776b3e514295a72d11601450709a/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 07:13:10 UTC
AV detection:
28 of 48 (58.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7elqzrw7nfzydev3hcelwe4w4joe53lhziuffnhfuiwafcqocna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97c8b86636fb4b9c0c95d9c445d89cb712e2776b3e514295a72d11601450709a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 97c8b86636fb4b9c0c95d9c445d89cb712e2776b3e514295a72d11601450709a

(this sample)

FormBook

Executable exe c53c864741e005d5b04ca3349e81597e61b8ee3ecd7a03cddd2d15d955cbb04a

  
Dropping
MD5 8f0593680392f53ee586bb66c2885d8f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c53c864741e005d5b04ca3349e81597e61b8ee3ecd7a03cddd2d15d955cbb04a

Comments