MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7fce1edc874a407a2526b66388b45cff1171aaecd504febe24691960eababd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7fce1edc874a407a2526b66388b45cff1171aaecd504febe24691960eababd3
SHA3-384 hash: 126e5d5c25f5deabf354193fbf8c9f1512ea6deb078957e5326d48b77aa681b61fc336da2f2af955d5f36bbdba9732b6
SHA1 hash: fbe0029fba9e20db44d278262c96a38a63fa990d
MD5 hash: 2bd82bde7645733bfd8533cefaf6e543
humanhash: east-shade-johnny-low
File name:Property.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'310'720 bytes
First seen:2021-03-09 15:58:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:wWvotGuCXzMfmdGec+DWs26KD/pxGEqsMFfD6STyl:wWvIEym4yZep7kD6STy
TLSH 0955BF32E291587BD1772B79DE5B56AD9829BE003F1CDC863BED9C4C8F366813814293
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: Kanzler Jenniferl<mail@webservice-secure.com>
Subject: Property Request
Attachment: Property.img (contains "Zargbqzk.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 15:58:13 UTC
AV detection:
13 of 43 (30.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=276od3oiossapissnntdrc2fz7yrogvozvie727ci2izmdvlvpjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7fce1edc874a407a2526b66388b45cff1171aaecd504febe24691960eababd3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img d7fce1edc874a407a2526b66388b45cff1171aaecd504febe24691960eababd3

(this sample)

Formbook

Executable exe db351de507bfb075469e69ffe4859653ca3b3d0729c0236a5d3f8fd935e01cde

  
Dropping
MD5 1147b7f65316255a2c423847ebfc5178
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db351de507bfb075469e69ffe4859653ca3b3d0729c0236a5d3f8fd935e01cde

Comments