MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1776c444d5cb867862fd71c5db0d2745016c6a9d8f588340e6395fd4c1fb9353. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1776c444d5cb867862fd71c5db0d2745016c6a9d8f588340e6395fd4c1fb9353
SHA3-384 hash: 9eca351af3ffbaf6cdfc5b6c645e42368ed98bbf12b78277b111707db8d19ef2cb989e7c4805f781125a9eafdaa3c30c
SHA1 hash: c6a9185db31e8ece8b0da466085f1a129a6c42cd
MD5 hash: 000091fe6c6f3a2c7e6f59bb5f790d2f
humanhash: alabama-november-missouri-pennsylvania
File name:Alfa Laval Aalborg AS Statement of Account_xlxs.xz
Download: download sample
Signature FormBook
Create hunting rule
File size:401'145 bytes
First seen:2020-07-21 07:50:21 UTC
Last seen:2020-07-24 10:23:33 UTC
File type: xz
MIME type:application/x-rar
ssdeep 12288:6eKoFAy/UUv5V+e+aefRicNR6nH4qH/n5he6:QANEe+aefRDRO4qHPN
TLSH DB8423D37BAC39511E7C169D1EDA1DF09914BF60F8193B6C278A11625FC7298902EB33
Reporter abuse_ch
Tags:FormBook xz


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: apple.itnti.net
Sending IP: 217.174.251.133
From: Technava SA - Lina Velli <l.velli@technava.gr>
Reply-To: I.velli@technava.gr
Subject: Alfa Laval Aalborg AS Statement of Account
Attachment: Alfa Laval Aalborg AS Statement of Account_xlxs.xz (contains "Alfa Laval Aalborg AS Statement of Account_xlxs.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1776c444d5cb867862fd71c5db0d2745016c6a9d8f588340e6395fd4c1fb9353/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:52:08 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c53mirgvzodhqyx5ohc5wdjhiuawy2u5r5migqhghfp5jqp3snjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1776c444d5cb867862fd71c5db0d2745016c6a9d8f588340e6395fd4c1fb9353

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

xz 1776c444d5cb867862fd71c5db0d2745016c6a9d8f588340e6395fd4c1fb9353

(this sample)

FormBook

Executable exe ceee0c8772c6b5a2cff7d9f3bc824c088f3c7d034b9898c74f79e11b59210257

  
Dropping
MD5 cc5e1a729a686d7ba8abe1dc8f00326c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ceee0c8772c6b5a2cff7d9f3bc824c088f3c7d034b9898c74f79e11b59210257

Comments