MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d500199104023a00949935fae7c2ee460996b15b90922d050fcf1411bfaea78d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d500199104023a00949935fae7c2ee460996b15b90922d050fcf1411bfaea78d
SHA3-384 hash: eb791a9008d78131332b59a73d77c86d052291f908f6e79a209f2cae93199adb310b897715792424e3d4485b770e0ccc
SHA1 hash: c26c1c7c3c5e11421a36ebb43c67501cc1627c24
MD5 hash: 061838aadc02472c9a2b5b5ff947470f
humanhash: idaho-freddie-hotel-zebra
File name:LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:300'710 bytes
First seen:2020-06-29 09:13:42 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:6aND24ONF+5+otEDLAdL0HLDc54o4PKfKTEx99mXQzvFHqURMlrmQ9gipUNVofe:9NaB+5+omggHLDEaifKT8qQDFjMZ3gmW
TLSH 9A542302C5E6974F178852CB99608F28D98DFF990CF17FB895D52C5E0B4262DE06E23A
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-742342.hostwindsdns.com
Sending IP: 192.236.161.86
From: PROCUREMENT MANAGER <levisandre@oilserve.com>
Subject: QUOTATION REQUEST OF PRODUCTS ATTACHED
Attachment: LIST OF PRODUCTS AND SPECIFICATIONS.bat.rar (contains "LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d500199104023a00949935fae7c2ee460996b15b90922d050fcf1411bfaea78d/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 09:15:06 UTC
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uabteieai5abfezgx5opqxoiyeznmk3scjc2bipz4kbdp5ou6gq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar d500199104023a00949935fae7c2ee460996b15b90922d050fcf1411bfaea78d

(this sample)

FormBook

Executable exe 5cdf6c041962460b405e1bba40fbfbda38571623012c2079fb6502178e860861

  
Dropping
MD5 cab5f0be747d073b503c26e443b9cdb2
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5cdf6c041962460b405e1bba40fbfbda38571623012c2079fb6502178e860861

Comments