MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a77c155e809047cc2d7948d2d88b3751e61e0b55a0ef4fd0aa2ec6c83f74f28b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a77c155e809047cc2d7948d2d88b3751e61e0b55a0ef4fd0aa2ec6c83f74f28b
SHA3-384 hash: c7cefbb86d37c4081b7b241660bf4b603a2350b0ca7de9abfea6dca48892cb4ab4841216a65f7ae1ec0c16a9248976fa
SHA1 hash: 6f3d3c12294339fda282addd093ab2ae668e6291
MD5 hash: e802f40d2da3db9758b1216ea8a589a5
humanhash: asparagus-xray-lamp-red
File name:Details.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:425'900 bytes
First seen:2020-07-06 09:09:45 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:22x8GIIYR8/atBU7bGkDL4xy7p63WhEg56Imn/V:Dx8Gs8/aEGRxG0gEgEt/V
TLSH D09423938A78041B7356427BD6510152EFC37D7BECABA55EC68F7A73E21EABC8017402
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: gains.granddubai.org
Sending IP: 45.83.97.22
From: cherian@deilami.ae
Reply-To: cherian.deilami.ae@mail.com
Subject: Response(Order)
Attachment: Details.zip (contains "Wbfwlkh.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a77c155e809047cc2d7948d2d88b3751e61e0b55a0ef4fd0aa2ec6c83f74f28b/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 09:11:07 UTC
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=u56bkxuasbd4yllzjdjnrczxkhtb4c2vudxu7ufkf3dmqp3u6kfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip a77c155e809047cc2d7948d2d88b3751e61e0b55a0ef4fd0aa2ec6c83f74f28b

(this sample)

FormBook

Executable exe 2680be0d6ab364c09e9ca33e93bc0dfa3de6906e014bdb4aafc77ea9caf76650

  
Dropping
MD5 8176ba16df3e7f6b889a53e675b35eee
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2680be0d6ab364c09e9ca33e93bc0dfa3de6906e014bdb4aafc77ea9caf76650

Comments