MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9f807d93940c83755b576e5ca2c7d971453cc6cf3bd855c8a2f6062a7c44200. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9f807d93940c83755b576e5ca2c7d971453cc6cf3bd855c8a2f6062a7c44200
SHA3-384 hash: ae8ead127a1f08d3ee869fc1f95a9b7f932ed16a54efff87f92f3506fe65f8590f423f0de03d7523781863253d1119d6
SHA1 hash: 0a8ba29f765341528e1f8bb4e128a92a78a9fbd1
MD5 hash: d7d4dde2f0ace0add56faea16ae40f05
humanhash: happy-magazine-kentucky-massachusetts
File name:2343234565432_pdf.gz
Download: download sample
Signature FormBook
Create hunting rule
File size:266'518 bytes
First seen:2020-06-11 09:33:58 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:8iLlOSYZVWJf5tK21i//ipOnrSkEDJNI3OJRM0XL:tgVWlJE/6OnrSXDPL
TLSH 86442313AB5DD0F814A85ECD811D3B6C18D874B663227864CC9A33DD4BB43791DBB9B2
Reporter abuse_ch
Tags:ESP FormBook geo gz Santander


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: cofradias.altia.es
Sending IP: 176.58.12.79
From: Factoring y Confirming - Grupo Santander <fycuot@gruposantander.com>
Subject: Confirming - Aviso de pago
Attachment: 2343234565432_pdf.gz (contains "scan2344321.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 09:36:05 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7h4apwjzidedovnvo3s4uld5s4kfhtdm6o6ykxekf5qgfj6eiiaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

gz f9f807d93940c83755b576e5ca2c7d971453cc6cf3bd855c8a2f6062a7c44200

(this sample)

FormBook

Executable exe 8155c967977dee334ccd8751bb30dbe3e2a134c387ac6d7e48ba5043e07441df

  
Dropping
MD5 7153dd1a182070ba494c1533ae26b185
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8155c967977dee334ccd8751bb30dbe3e2a134c387ac6d7e48ba5043e07441df

Comments