MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3
SHA3-384 hash: 9f067a797e49c4793f1249e9ce11f4c3613f2796e3bd321baeaf4bb8bc1607ecfd192aff8b715568c46e2f61f429cc7a
SHA1 hash: 6f4f2e7f3ac42e48cc4ad431d9dc14c32014bd97
MD5 hash: 7cb7a5648642ad1dcb7c497f4ed3afcc
humanhash: magnesium-network-pasta-ink
File name:55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3
Download: download sample
Signature Formbook
Create hunting rule
File size:717'824 bytes
First seen:2020-11-13 15:21:21 UTC
Last seen:2024-07-24 14:30:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 64b57a6f98a31b50be7a854188edcd25 (6 x AgentTesla, 3 x Formbook)
ssdeep 12288:vyDBWCDdczEqRsWTQ7ZpDf86yfNdbAgrLmD3SQON72OZ:+BVSyf86yPyDi3QOZ
TLSH 95E46B81744FC3F3C4521D704D3489B0E9197CA7AA605E4FE2D63DF95A32FB89DA122A
Reporter seifreed
Tags:FormBook

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.File.Gamehack-9659256-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
Launching a process
Launching cmd.exe command interpreter
Sending a UDP request
Setting browser functions hooks
Forced shutdown of a system process
Unauthorized injection to a system process
Unauthorized injection to a browser process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3/
Threat name:
Win32.Spyware.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:23:08 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201113-hp96qpvc2s/
Unpacked files
SH256 hash:
55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3
MD5 hash:
7cb7a5648642ad1dcb7c497f4ed3afcc
SHA1 hash:
6f4f2e7f3ac42e48cc4ad431d9dc14c32014bd97
Link:
https://www.unpac.me/results/99b310c3-ce3e-4227-9b29-1ea931d8dc9c/
SH256 hash:
794583cd3354fcb78c26dfaa63d7f5e35c5bc5699bc6db03b427016424ca26e4
MD5 hash:
069f92a9097ccf845d479b1aec615708
SHA1 hash:
45f2081dae744b5ea5b3d32b4543e68f1e2500a2
Detections:
win_formbook_g0
Create hunting rule
win_formbook_auto
Create hunting rule
Link:
https://www.unpac.me/results/99b310c3-ce3e-4227-9b29-1ea931d8dc9c/
Parent samples :
a59693f90c55791c544845b00cd4a8e6333d83cc83c8d8be42a7b028af4098e0
60e0625b9dc6a06473b96fd2972c145e71120d7d6a106713c76d7be4ccf75478
7b55f6fa510718db214cc578df054de13177b21eb20194b87f97c477ffc572d5
c63da2dca25d6d1c17fcfd8041424f2232878b734072ab55f1c31a6fa083a9fa
cab05c453ff61226526341a1ff169339c019e61fd894bcd82aac8599ea61ca7a
6f463e4599313c87551cfc529feb1b20b5eccc8f4fd20f66fafe580140e109f9
55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55aebdda73f158c6b5d24ec671226540690112f2b412f073deb173b932c7f6c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments