MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc56f8319fd0bd85861ba6a623824a84c84a230edfb7234ea47bb90845da48ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc56f8319fd0bd85861ba6a623824a84c84a230edfb7234ea47bb90845da48ef
SHA3-384 hash: d74c0bed22515bbc7a7ba6f39894e0392f408c01cbf7627bd99a8ef587b599f55c1e1ceb4d99bbcf09672426ee371a8b
SHA1 hash: b3d5af008fbf8c5e0a0b6d956bc33c79c927e5ae
MD5 hash: f1599b7270d33a5132a8f75461337d92
humanhash: don-west-oxygen-green
File name:Shipment Document BL,INV and packing list.ace
Download: download sample
Signature Formbook
Create hunting rule
File size:366'953 bytes
First seen:2021-02-25 09:33:55 UTC
Last seen:2021-02-26 15:34:27 UTC
File type: ace
MIME type:application/octet-stream
ssdeep 6144:hMTNEiMtRQFFO1/n19Bsqw5v4MKd/AxzoMvjQWeeclgik5M23tuP9HDpf:hMTKXQ+19BsqwNc/AxzoMvjQWt3lMSCP
TLSH 317423B67B107A17B66BC8C33456D966FF8545E8428C0D2E3BF99C3D28BDE0B50A7205
Reporter cocaman
Tags:ace DHL FormBook


Avatar
cocaman
Malicious email (T1566.001)
From: "Shipping@DHL.com" (likely spoofed)
Received: "from [103.87.172.228] (unknown [103.87.172.228]) "
Date: "25 Feb 2021 20:07:46 -0800"
Subject: "Shipment Document BL,INV And Packing List Attached"
Attachment: "Shipment Document BL,INV and packing list.ace"

Intelligence

File Origin
# of uploads :
3
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25738.AceHeur.Exe.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25166.AceHeur.Exe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Suspicious-ACE-exe.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc56f8319fd0bd85861ba6a623824a84c84a230edfb7234ea47bb90845da48ef/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 07:18:03 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rlpqmm72c6ylbq3u2tchaskqteeuiyo363sgtvepo4qqro2jdxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

ace dc56f8319fd0bd85861ba6a623824a84c84a230edfb7234ea47bb90845da48ef

(this sample)

Formbook

Executable exe 10d80e3275154e9e39e98d3622a7af4f98a5fd1f0a073839d9e8d670cbd5d3e6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 10d80e3275154e9e39e98d3622a7af4f98a5fd1f0a073839d9e8d670cbd5d3e6
  
Dropping
Formbook

Comments