MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8
SHA3-384 hash: 9ce757383daf122b25dd8d0240b41f0525d7cc366389cf74cf43e94ecd744ccaa3c5c9618e2f4df7b547c5ecf85feae1
SHA1 hash: 18f4077403d5cb0530ba6c45488480bb534a4117
MD5 hash: 0f9eb810be9b50a8b2d6c7c7988cb6c5
humanhash: mississippi-carbon-alaska-five
File name:Requirement list.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:422'166 bytes
First seen:2020-07-10 06:16:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5UrVGw5EWJGW+zQNiaDYi3uh9WH0iHhHWMWJX0urm8Csp:esw5E7zQNP3uhEXHWZDm8CM
TLSH AA9423DC99CDFF8C0D5D930DF4364D489AD1F03407294A74B09F21653AA32AA8BEAB56
Reporter jarumlus
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.6016.5488.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 11:26:02 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yr5wjpbqqlcz2vahplyepqv477indbmzgsjh3rmp7qklplcsuhea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c47b64bc3082c59d54077af047c2bcffd0d1859934927dc58ffc14b7ac52a1c8

(this sample)

FormBook

Executable exe def5dbf8e48af782ccb741ff6a1e1357af8dcafb701089b7f2d1c0919ae79f05

  
Dropped by
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 def5dbf8e48af782ccb741ff6a1e1357af8dcafb701089b7f2d1c0919ae79f05
  
Dropping
MD5 5dff100422e961e681af596f5307ba6d

Comments