MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5ba13e6df47fe733605760f67879589ede9cc5e1bdfe7d258053292b3a92f25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5ba13e6df47fe733605760f67879589ede9cc5e1bdfe7d258053292b3a92f25
SHA3-384 hash: bb1b92965d41511e7553ac09ea199c0fe7a05fb7b848c78ea908fbe1b3bd492c5a2b02ba488a02e9ffb2be1dc5417a6a
SHA1 hash: 9f4d1b4c3fd2d2ddc322b90475f4b6131612c3c9
MD5 hash: b5a8188943cb16891ce1eaaf822d7b6b
humanhash: zulu-queen-island-victor
File name:Quotation.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:207'489 bytes
First seen:2020-07-20 09:25:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:Q/0ciVtxAR5rsBw9UkWfEwGkEpDIJhJDG6ALp3dGbjvn9klScEwfWFYlvkj0:Q/0cCxARy66VEpD+Gh1topSe+lvkj0
TLSH D4142312BC233346472EC2B50990AC4C7389E47AA365E3F5F673A2F1D4F8855790F9A6
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: simon.simontasarim.com
Sending IP: 93.89.17.2
From: Purchase <operations@rixosgsm.com >
Subject: Quotation and Sample of Products
Attachment: Quotation.zip (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21199.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5ba13e6df47fe733605760f67879589ede9cc5e1bdfe7d258053292b3a92f25/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 09:26:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uw5bhzw7i77hgnqfoyhwpb4vrhw6ttc6dpp6pusyauzjfm5jf4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5ba13e6df47fe733605760f67879589ede9cc5e1bdfe7d258053292b3a92f25

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip a5ba13e6df47fe733605760f67879589ede9cc5e1bdfe7d258053292b3a92f25

(this sample)

FormBook

Executable exe 4334ef4236c8a8b7c1c3463875315f16b35ba1d4dfac8c67f8c0cb81f950d850

  
Dropping
MD5 d4c9b70407d77f1d3422c386d5239044
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4334ef4236c8a8b7c1c3463875315f16b35ba1d4dfac8c67f8c0cb81f950d850

Comments