MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caeaf0b1b621086b4ef44d22a349124626feaeb4d2df8675cba19e6fb645d656. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: caeaf0b1b621086b4ef44d22a349124626feaeb4d2df8675cba19e6fb645d656
SHA3-384 hash: a71783015e30eb02ef2911e351802e9a6bb21ff46457038827ebba10ecce16e69c092b3a9a3788463dc0c2b0cba7bd27
SHA1 hash: 43185ef92a7af804fc67818068a60be180b57993
MD5 hash: b3686f0d6a4b8d29678c8b5ebe6530c6
humanhash: muppet-johnny-eighteen-uranus
File name:Remittance advice.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:515'235 bytes
First seen:2020-07-10 17:47:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:Iy3rsUloMPGrupwTMaL2SUtr6GdBF5E9bBmwNfEBrT7:IPUlLGrbTMaL2SUtr6ej2LdpEV
TLSH F1B4237FF335DF07D971920BAA5AD5D9D323CC19308B0D1A64A892D0009BFAE7A2EC54
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: servidor.quoqle.es
Sending IP: 185.37.226.85
From: Accounts Payable <atostradingest@mail.com>
Subject: Re: Remittance advice
Attachment: Remittance advice.zip (contains "Remittance advice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/caeaf0b1b621086b4ef44d22a349124626feaeb4d2df8675cba19e6fb645d656/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-10 17:49:04 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlvpbmnweeegwtxujurkgsisiytp5lvu2lpym5olugpg7nsf2zla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip caeaf0b1b621086b4ef44d22a349124626feaeb4d2df8675cba19e6fb645d656

(this sample)

FormBook

Executable exe ab12a111885480b3518449ff615d118b0ba908e4f3f0179c8da797c7c815cbfe

  
Dropping
MD5 6b72bf98756a106ce4ffb0d7ef1be954
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab12a111885480b3518449ff615d118b0ba908e4f3f0179c8da797c7c815cbfe

Comments