MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77588752b87ce78930b44641b581476a8346879b082358dc98ad4d666ecae44e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77588752b87ce78930b44641b581476a8346879b082358dc98ad4d666ecae44e
SHA3-384 hash: 8f1502e54ce81d19a2c42504d10016a3db719491a2f1fbd8ac128897e77436decab672123030fb8eecb0696991b61686
SHA1 hash: ec351293ff9e5bbc09109e4c3894e3c02fd549fd
MD5 hash: 7d403dd0d8b5da9a9490eba98639d09d
humanhash: friend-nevada-lamp-bacon
File name:Payment Invoice pdf.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:485'911 bytes
First seen:2021-03-09 13:58:16 UTC
Last seen:2021-03-11 04:00:39 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:e4p9OZfTjiFY+2j9owzO0vNeXV/dvCcQaG:VbOZfnB5ownv4VvC/n
TLSH E8A423FC578BB120C855CE3D48C309FF82798B68EED956BD817E506084A96BE4F0DE91
Reporter cocaman
Tags:ace FormBook INVOICE


Avatar
cocaman
Malicious email (T1566.001)
From: "XINXIANG AIDA MACHINERY EQUIPMENT CORPORATION <xinxiang.aida@928.gvnxo.ga>" (likely spoofed)
Received: "from postfix-inbound-3.inbound.mailchannels.net (inbound-egress-5.mailchannels.net [199.10.31.237]) "
Date: "Tue, 09 Mar 2021 06:13:11 -0600"
Subject: "PAYMENT APPROVAL INVOICE # 39265474"
Attachment: "Payment Invoice pdf.ace"

Intelligence

File Origin
# of uploads :
7
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 13:59:06 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o5miouvypttysmfuiza3lakhnkbunb43barvrxeyvvgwm3wk4rha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77588752b87ce78930b44641b581476a8346879b082358dc98ad4d666ecae44e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace 77588752b87ce78930b44641b581476a8346879b082358dc98ad4d666ecae44e

(this sample)

Formbook

Executable exe 220f3d2b4e15b67592dc527153c3b7107d1465ef90339b8c00c0db2f9cc245fc

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 220f3d2b4e15b67592dc527153c3b7107d1465ef90339b8c00c0db2f9cc245fc
  
Dropping
Formbook

Comments