MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f90b98c07c5e10bdcdc3a15a7563b04da76a4a916b914690828288760df8821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2f90b98c07c5e10bdcdc3a15a7563b04da76a4a916b914690828288760df8821
SHA3-384 hash: 2ca6dabbb9ad3554b91df98ed7fe5ea37260bef6566915f8e4708d0751a9ea98e53ae84f9a1bbe6b68e5193785c98725
SHA1 hash: 9357a15c983cf7ac53e70810bf4fd861a1c85879
MD5 hash: 0b39591be48b98891c133a1c8e71fcde
humanhash: ohio-triple-kitten-network
File name:Purchase Order No.MDR-040.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:561'400 bytes
First seen:2020-08-31 06:23:52 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:nJ4Rj1E7z/f3lVgdjENgWuOvDBXBw1RmGtaHWdZIHV3QFhgE:nY1ITf3r4qxvTiRpaeIHVgF+E
TLSH BAC42332D2ABC1A41C502AACFC76820A1F4F77924554D07FC9A128D8761D8E3F7BD69E
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server.alamsuterarealty.co.id
Sending IP: 43.251.98.3
From: Akhmad Adiwongso <akhmad.adiwongso@alam-sutera.com>
Reply-To: akhmad.adiwongso@alam-sutera.com
Subject: Revised Purchase Order
Attachment: Purchase Order No.MDR-040.arj (contains "Purchase Order No.MDR-040.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2f90b98c07c5e10bdcdc3a15a7563b04da76a4a916b914690828288760df8821/
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 00:22:34 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f6iltdahyxqqxxg4hik2ovr3atnhnjfjc24ri2iifauioyg7raqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2f90b98c07c5e10bdcdc3a15a7563b04da76a4a916b914690828288760df8821

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 2f90b98c07c5e10bdcdc3a15a7563b04da76a4a916b914690828288760df8821

(this sample)

FormBook

Executable exe a05ae5c56a5a5c24f2c7276f2c669cb33c09f87d75a09030b094f12a4a1a17fa

  
Dropping
MD5 227937eb3ed18110492a068caed979cc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a05ae5c56a5a5c24f2c7276f2c669cb33c09f87d75a09030b094f12a4a1a17fa

Comments