MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c2d3f8ec1fb9f48007a773ad325b7de4a2949be6f8273587254d9e9bdb477d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c2d3f8ec1fb9f48007a773ad325b7de4a2949be6f8273587254d9e9bdb477d0
SHA3-384 hash: 86c4f69b2e27e46dc5ca0b99e6927da273fb8fb2763dc2a5a473ebe5513c5ade59003411ab2c0c64bda2df86ad838717
SHA1 hash: dd84518fe4bc6c519234f551e4731d81a335a734
MD5 hash: 166c69e33114a621da22a3790f45f804
humanhash: july-oscar-gee-red
File name:ordem.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:451'512 bytes
First seen:2020-10-21 07:04:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:/e8lMQUexdLNOICp2MASfolJqAiQboVVf85:28lMexdQVqniyoo
TLSH 6AA42389CF8A02F04B4E1C39FC5AE4B591A22B1E3397F4C11E0DD71A992A5D3DDB6A14
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Diana Ortiz <mostiack@pmfezer.com.br>
Subject: Re: Re: Ordem de Compra
Attachment: ordem.zip (contains "ordem.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.29646.24100.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c2d3f8ec1fb9f48007a773ad325b7de4a2949be6f8273587254d9e9bdb477d0/
Threat name:
ByteCode-MSIL.Spyware.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 16:31:33 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dqwt7dwb7opuqad2o45ngjnx3zfcssn6n6bhgwdsktm6tpnuo7ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 1c2d3f8ec1fb9f48007a773ad325b7de4a2949be6f8273587254d9e9bdb477d0

(this sample)

Formbook

Executable exe d0d44ccb48b649e89a18773ccea8337047e57247d29dbedc1abab31f265e7e45

  
Dropping
MD5 a89477469f2b24fa624b930f4b631e69
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d0d44ccb48b649e89a18773ccea8337047e57247d29dbedc1abab31f265e7e45

Comments