MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276
SHA3-384 hash: 13099b1025f92ee479f42d994f2c1968af8ead845f2c8fee706faab650af87311d6fbcfd922375547d3f69ec50fa3911
SHA1 hash: 345589ec90aeb8547c82ccc6bd96ab785c9923ff
MD5 hash: 0ab333af7d6758ebe4a52500940a0d74
humanhash: quebec-maine-august-failed
File name:LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:301'926 bytes
First seen:2020-06-30 05:55:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Xs51EAHqQzOeKx5dykRbTYNL7eGlWXCPlaiTWXSjM2XGmgM+gqn2SdMNIz:XsTEgz3Y5dRfYNXb9IS+mgM+52Snz
TLSH 465423B21D9DB24F33A993A3E614691F3E13339BF0E0614D711367834826EADA5CC7A1
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mtk0.zmsyd.com
Sending IP: 45.95.171.11
From: PROCUREMENT MANAGER <p.m@zmsyd.com>
Subject: QUOTATION ON THE PRODUCTS ATTACHED
Attachment: LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar (contains "LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 05:57:04 UTC
AV detection:
14 of 27 (51.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eadpdu4xkbvbztgqoet7tz7ihxue4egqszzhd7r4tuz6keltej3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 2006f1d397506a1cccd07127f9e7e83de84e10d0967271fe3c9d33e511732276

(this sample)

Formbook

Executable exe 1bf9db8285719827160844a6a51292c30346c3099a4753c92177cba4e59b2404

  
Dropping
MD5 1d2585eb104895bd6a4059cee636cee7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1bf9db8285719827160844a6a51292c30346c3099a4753c92177cba4e59b2404

Comments