MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a153adc2cccda97da65315979e062da60f392da24fb1f9b14a1c0e848aaa5ae6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a153adc2cccda97da65315979e062da60f392da24fb1f9b14a1c0e848aaa5ae6
SHA3-384 hash: 3dfe31368c1c23fbd23f226eb75f2d18cb3a4630790a5ff64953ffdc651a6c094bf4b5bdf8a0797b2db85165614fdf93
SHA1 hash: 668e4de49b8306cffc6a7b33e1a15b05aac699f8
MD5 hash: d32fc276228cb8f8366c4f8f5895b5bf
humanhash: fix-indigo-avocado-equal
File name:REQUEST FOR QUOTATION.ace
Download: download sample
Signature FormBook
Create hunting rule
File size:600'521 bytes
First seen:2021-02-23 07:11:38 UTC
Last seen:2021-02-25 23:56:39 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 12288:28aEw4p9jUSsabbo8Jq3Cv5GCgwiQol8Ftp4CBLmCHaIL4FjLN2mu2whvnJ:28awWi0aqufpiQF4yGp2d2whx
TLSH 1CD433097CCD51D356937EEA9487E34A100739AAFFC0B68C27898C6185B5A1EC947CFA
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
8
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a153adc2cccda97da65315979e062da60f392da24fb1f9b14a1c0e848aaa5ae6/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 23:48:51 UTC
AV detection:
11 of 47 (23.40%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ufj23qwmzwux3jstcwlz4brnuyhtslncj6y7tmkkdqhijcvkllta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a153adc2cccda97da65315979e062da60f392da24fb1f9b14a1c0e848aaa5ae6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

ace a153adc2cccda97da65315979e062da60f392da24fb1f9b14a1c0e848aaa5ae6

(this sample)

FormBook

Executable exe 65dbaf77c991e5737ecf9041dea34a7e9eca1e38925ff69340435a3cff1314a3

  
Dropped by
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 65dbaf77c991e5737ecf9041dea34a7e9eca1e38925ff69340435a3cff1314a3
  
Dropping
MD5 1d229f76672a250bd0c2ff84417d63e3

Comments