MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f1815977c76fe556eb059651469bb0d6717347c25fd7f8c85129f57da429423. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f1815977c76fe556eb059651469bb0d6717347c25fd7f8c85129f57da429423
SHA3-384 hash: 803ff9accd070fc0607f4509da2f1d8d7b296d827fb36d60c4509ea737490435be1a48431d722be3d8722c18ae189ee7
SHA1 hash: d0ae3f2d1003d010eb362f950d3dff005a3b3aac
MD5 hash: fe967a18b90ba479e83417af0256a331
humanhash: ceiling-cold-beer-kentucky
File name:RFQ for Vostok.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:411'194 bytes
First seen:2020-06-22 11:12:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2OQA7qNEUSPmHJGsSTeW/sW3caTKTIa2U4v0Hrn1:2OQYUSP+JGfTemdcaOTB34v0L1
TLSH 029423CC799D01500FF679BBA962B855FD8D942B36714BC68CDABC1742C1E80354BFA2
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email
From: "Anastasia Petrov" <hr@vnplywoodor.net>
Received: from vnplywoodor.net (ns1.vnplywoodor.net [104.168.200.185])
Date: Mon, 22 Jun 2020 12:56:12 +0200
Subject: Re: Urgent Inquiry for Vostok Group
Attachment: RFQ for Vostok.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21777.RarHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f1815977c76fe556eb059651469bb0d6717347c25fd7f8c85129f57da429423/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 11:14:04 UTC
File Type:
Binary (Archive)
Extracted files:
294
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4mblf34o37fk3vqlfsri2n3bvtrond4ex6x7defckpvpwscsqrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 1f1815977c76fe556eb059651469bb0d6717347c25fd7f8c85129f57da429423

(this sample)

FormBook

Executable exe 12f801c37aa2f91921e145d6860aa5f2bdb0e0ef9fcadd07de9b00fb8ed91338

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 12f801c37aa2f91921e145d6860aa5f2bdb0e0ef9fcadd07de9b00fb8ed91338
  
Dropping
FormBook

Comments