MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c95f9e90aaeb91676dbfca9f2fbc9bf8538faee5903f4c56bce290ef28d6722b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c95f9e90aaeb91676dbfca9f2fbc9bf8538faee5903f4c56bce290ef28d6722b
SHA3-384 hash: 6ecb24583a29d2478f87583b1cf9525d6a949eed2dcd1ce5fd09e46111d7e530123b0e0f0a750c31871d9a167d7963b0
SHA1 hash: 1aa2498f473b184ae75a5caf403b1369f2cbbf3b
MD5 hash: 77ccd043380bb969e37c9d9718a7728a
humanhash: dakota-lemon-carpet-massachusetts
File name:Specs INQUIRY.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:295'184 bytes
First seen:2020-07-22 06:43:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:56E6+P647Um/5+q7dFmt1wcz19d+bhyC4IqMwoiP7mluLW:5N364wmB+q7dFRkkbhxcPigi
TLSH 9E54231EC13753B5EF9B33389BADF826C68A76105253D6F9771921AC087A5A2C3F8D10
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sinolift.com
Sending IP: 45.143.223.143
From: sinolift@sinolift.com
Subject: RE : 自动回复： INQUIRY
Attachment: Specs INQUIRY.zip (contains "Specs INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c95f9e90aaeb91676dbfca9f2fbc9bf8538faee5903f4c56bce290ef28d6722b/
Threat name:
Win32.Spyware.Negasteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 06:45:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfpz5efk5oiwo3n7zkps7pe37bjy7lxfsa7uyvv44kio6kgwoivq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c95f9e90aaeb91676dbfca9f2fbc9bf8538faee5903f4c56bce290ef28d6722b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c95f9e90aaeb91676dbfca9f2fbc9bf8538faee5903f4c56bce290ef28d6722b

(this sample)

FormBook

Executable exe 3c15d1bb32d82a136a76d6e8867506dc2cc12cc183ed5a5c79335cb569e7d52c

  
Dropping
MD5 84c148d04013e64d21ebac8e8b1fe121
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3c15d1bb32d82a136a76d6e8867506dc2cc12cc183ed5a5c79335cb569e7d52c

Comments