MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4baff4aa424c45dbd075ad57b592bf2e7c1a9d97c43715fc5916e3086fe5f00d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4baff4aa424c45dbd075ad57b592bf2e7c1a9d97c43715fc5916e3086fe5f00d
SHA3-384 hash: 3bc51041a87ad65250ea16051e24d827af0f41bb27cf4b86aef1e4858f415627002ac646896e2b0f23a9412417fc0aec
SHA1 hash: 3ec40c97dc834a5b1ea9d7b26b52f557ab512880
MD5 hash: 9950f046e18ac93520fe4c695e1c75f0
humanhash: colorado-utah-lamp-stairway
File name:slip.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:189'390 bytes
First seen:2020-08-10 09:58:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:WPG9RyjF2dc+tgOP+5pbX3177NQJEHInQsd0XdM67llYCqf95DYMaOcb70OGQi2P:W+AF2dc+tl+HXFXNPaQq0WG2zDYXOu0a
TLSH B70423AA083E3F6D2859F87A4A5AC17F445FD28AE964C1AF38F69BD24DD5A330034704
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpanel716.webserver.sg
Sending IP: 103.104.196.130
From: byyam@te.my
Subject: BANK IN SLIP
Attachment: slip.zip (contains "slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21512.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4baff4aa424c45dbd075ad57b592bf2e7c1a9d97c43715fc5916e3086fe5f00d/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 10:00:11 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jox7jkscjrc5xudvvvl3lev7fz6bvhmxyq3rl7czc3rqq37f6agq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/4baff4aa424c45dbd075ad57b592bf2e7c1a9d97c43715fc5916e3086fe5f00d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 4baff4aa424c45dbd075ad57b592bf2e7c1a9d97c43715fc5916e3086fe5f00d

(this sample)

Formbook

Executable exe 5ad5a878cb51009bc4e935705c0a1ef60654891dd16fe19f728f344b5aaeff2e

  
Dropping
MD5 3fd6a71c130a70ce4f42b759a358cc46
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5ad5a878cb51009bc4e935705c0a1ef60654891dd16fe19f728f344b5aaeff2e

Comments