MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12b3629012a4080f3577686ba6b37b4b6343e6a60b0e34b67afb6552851f17b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12b3629012a4080f3577686ba6b37b4b6343e6a60b0e34b67afb6552851f17b4
SHA3-384 hash: ef597c57d34881a6cc76a80ce48e13b4ee646d6a27a63ef304dd7dff46d930290e3842c55350a9496acb9ac276f7c613
SHA1 hash: 633939c09611a71ecec44643f33d581085f0d38a
MD5 hash: 1c6c907a4edead30cf44211ff93ad0a3
humanhash: twelve-indigo-uniform-mobile
File name:HENB790.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:799'084 bytes
First seen:2020-11-06 07:34:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:SQ73LPosE1xrfpwE01/pSdazcUmrtMKLx9BdTx:SQLLP1EDrfpZESd5ZMKLJJx
TLSH C9053335DD295C9F878D32A7786F234D78429DD20DEA55F19E4EAF3304B311202A39A7
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic304-23.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.68.204
From: Ali joy <joyali124@yahoo.com.sg>
Subject: FW: Payment Transfer
Attachment: HENB790.rar (contains "bSpRY88fjIgazcB.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12b3629012a4080f3577686ba6b37b4b6343e6a60b0e34b67afb6552851f17b4/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 07:36:08 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckzwfeasuqea6nlxnbv2nm33jnruhzvgbmhdjnt27nsvfbi7c62a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 12b3629012a4080f3577686ba6b37b4b6343e6a60b0e34b67afb6552851f17b4

(this sample)

FormBook

Executable exe 8ca4a5887d8506ae275cdc9d9ba89dab07e2997435435a1f0bd111f78ad0a382

  
Dropping
MD5 a04ca4b29a48705a10d05e63492c397b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8ca4a5887d8506ae275cdc9d9ba89dab07e2997435435a1f0bd111f78ad0a382

Comments