MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a5f3b4f255b9b2154a05ffd9d25cab985f9f74a81e6e501ff91949b82ca223b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a5f3b4f255b9b2154a05ffd9d25cab985f9f74a81e6e501ff91949b82ca223b
SHA3-384 hash: 0ae143364ff904f38c3a68884141e91760fc105d71e41be910e0b42222cd6c51691c249f976cb0343ac24cf420040efe
SHA1 hash: 67e55ba512bb4c68c33f65ec886a00e45752f5ce
MD5 hash: f3c6d6b88bd07b6b5e9531f578e28282
humanhash: quebec-nitrogen-fanta-december
File name:Email PO.r03
Download: download sample
Signature Formbook
Create hunting rule
File size:611'005 bytes
First seen:2020-10-15 10:34:36 UTC
Last seen:Never
File type: r03
MIME type:application/x-rar
ssdeep 12288:kvbOL/nZEqnX31haKICojMkFRqaCXdoYrdqOs7FPGsRJCuoKYYNTTc:kjOL/ZEqH18KICeMTawdbUO+FOxT+o
TLSH 5CD423D74A63A46A69B19ACBCAFC51530D4C8608108D7B1B94CDF14341B62DFEB7A8F3
Reporter abuse_ch
Tags:FormBook r03


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: citech-bd.com
Sending IP: 103.141.138.124
From: FKN GROUP <fkn@citech-bd.com>
Subject: PO# 48762020
Attachment: Email PO.r03 (contains "Email PO#.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a5f3b4f255b9b2154a05ffd9d25cab985f9f74a81e6e501ff91949b82ca223b/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 13:03:25 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljptwtzflonscvfal76z2jokxgc7t52kqhtokap7sgkjxawkei5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5a5f3b4f255b9b2154a05ffd9d25cab985f9f74a81e6e501ff91949b82ca223b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r03 5a5f3b4f255b9b2154a05ffd9d25cab985f9f74a81e6e501ff91949b82ca223b

(this sample)

Formbook

Executable exe 5007dc70fdff0e6a544f49c91da3ce378772cb397cdbb0bb3af33f4acb714add

  
Dropping
MD5 1a3ae8b6306b1d6a1fc713c0c95669ef
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5007dc70fdff0e6a544f49c91da3ce378772cb397cdbb0bb3af33f4acb714add

Comments