MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 068d7339c898cd317b11fdc864c13d16820a399254698c01f3f796969c78f6cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 068d7339c898cd317b11fdc864c13d16820a399254698c01f3f796969c78f6cb
SHA3-384 hash: fc430f7d6658f3a5561dfa3c210cb0ad4ba565573d87527bddd592b69289a3718f98f4ce76c4fd7eb847cf3af84a6416
SHA1 hash: 4abf0c17bbfac73ee1b301555b1d7beb1a3c735c
MD5 hash: cb3dc5c18b6f1ff984ad81a24484e238
humanhash: july-speaker-moon-texas
File name:Q12039329293.pdf.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:676'652 bytes
First seen:2020-10-13 07:21:49 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:rFaSD2OKTVFlYCI8oNT4W2vITEthOWwcttr88PA27jwNGWcv7ABrnBp:rscRqDlopovIItk6FDt7jwNGW6WBp
TLSH 3AE423F9D4227CD1164EA33423A50B0A392692C9356ED736CC6E9648F29CDDCDB8374B
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.forecastle-shipping.com
Sending IP: 202.93.27.5
From: Tri Abriyanto (Edo) <tri.abriyanto@heintlogistics.com>
Subject: Fwd: RFQ#IM201014BID , CIP AIR SHIPMENT FM HKG-CGK
Attachment: Q12039329293.pdf.gz (contains "Q12039329293.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/068d7339c898cd317b11fdc864c13d16820a399254698c01f3f796969c78f6cb/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 03:23:09 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2gxgooitdgtc6yr7xegjqj5c2bauomskruyyapt66ljnhdy63fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/068d7339c898cd317b11fdc864c13d16820a399254698c01f3f796969c78f6cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 068d7339c898cd317b11fdc864c13d16820a399254698c01f3f796969c78f6cb

(this sample)

Formbook

Executable exe bdad93534a202f7d3c2f102dc39093fa12a32f5de82c76a5fb41a94e1748d99e

  
Dropping
MD5 bb2dd1ac3f2b032c982d1154a07334eb
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdad93534a202f7d3c2f102dc39093fa12a32f5de82c76a5fb41a94e1748d99e

Comments