🀲🏼 NEW | abuse.ch Community Hub! Earn recognition πŸ… for the malware intelligence you share, climb the leaderboards πŸ“ˆ, and connect with like-minded contributors who share your hunting focus 🀝. Ready to unlock your profile? Go to the Community Hub β†’

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67e2ee641e0f1e2615ca1b413f8ff60307ca4a40335bcd529d7d8d7569a37286. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67e2ee641e0f1e2615ca1b413f8ff60307ca4a40335bcd529d7d8d7569a37286
SHA3-384 hash: 7314ccc38c561863799b6d120af67b75d0955bb35b94d80aaed660b6b5d7f0a072d2c9cbfd3078f30cca68df8947a193
SHA1 hash: d752a56286b07a72c84ff735e77139bd64a42352
MD5 hash: f3d1ccb2cfc38eb8e04cf656ae1e17a0
humanhash: chicken-saturn-december-chicken
File name:Purchase order ADFG-20200706.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:482'237 bytes
First seen:2020-07-06 06:32:24 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:f4bOUE0FkeI+c+70OvfiAWXjnGpHzIoMXhPshtHY3JGhz:wbpDkeI+R0Oy1XjniyhPsQ3Qhz
TLSH 5FA4230F965F89CC941A137FEC557EA02C20FEA4D553AD2517E320B10AAFCB5FA2C948
Reporter abuse_ch
Tags:FormBook geo KOR zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mailtx2.nate.com
Sending IP: 117.53.114.132
From: 이운규 <hoh259@nate.com>
Subject: λ°œμ£Όμ„œ - (μ£Ό) ν•œν™”
Attachment: Purchase order ADFG-20200706.zip (contains "Purchase order ADFG-20200706.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.24764.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/67e2ee641e0f1e2615ca1b413f8ff60307ca4a40335bcd529d7d8d7569a37286/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:34:08 UTC
AV detection:
29 of 48 (60.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m7ro4za6b4pcmfokdnat7d7wamd4ussagnn42uu5pwgxk2ndokda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 67e2ee641e0f1e2615ca1b413f8ff60307ca4a40335bcd529d7d8d7569a37286

(this sample)

FormBook

Executable exe d48571bc8422f8413510d8f59ab12afc84dff1c08f25e75240599d2b9a8a63fb

  
Dropping
MD5 2de71b90709956f9044e682697308551
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d48571bc8422f8413510d8f59ab12afc84dff1c08f25e75240599d2b9a8a63fb

Comments