MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7
SHA3-384 hash: 74339d54d3d4e0e2c4bdf3b3a2e8f1189008771d747696f3cfc2f1d2b6b551de9d0b77d964c441393ecd39e793f4ef2b
SHA1 hash: c7e5189e5e38f6cc5e6ea967308046ddd3cbb89c
MD5 hash: 318c646f7a9399d135ef550ba6309f37
humanhash: massachusetts-oranges-november-angel
File name:19882772020_pdf.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:450'560 bytes
First seen:2020-07-21 06:27:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:xg1kcKt3RAzsuY+nHxpKqs4jZ0CS+uOLVWJ:xgScvsuFHxUK90CSmO
TLSH E7A4237C421B0D66E52AD1A025874E6EAD831CCA4F229BE0F7D295BB4B93B7DF06D005
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: apple.itnti.net
Sending IP: 217.174.251.133
From: logistics <logistics@amosgroup.com>
Reply-To: logistics@arnosgroup.com
Subject: RE: FW: orders in AMOS - EAGLE VERONA*Busan call 19882772020
Attachment: 19882772020_pdf.zip (contains "19882772020_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:29:07 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vbrr7szbzgzmgd5mf2zpdseugtrx4buurgqup743yeuszd44t3lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip a8631fcb21c9b2c30fac2eb2f1c89434e37e069489a147ff9bc1292c8f9c9ed7

(this sample)

FormBook

Executable exe 062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d

  
Dropping
MD5 4deba1639a8052a297693289210e7d8f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 062778fce91ba3c9ecc4b3cc3cb5b4e3f41846699307fe2da8295c3b3da0339d

Comments