MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6300f64cc66cdf1ccb9e954f8c806926d35fca1ce2e5bce5ec28e425251fed64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6300f64cc66cdf1ccb9e954f8c806926d35fca1ce2e5bce5ec28e425251fed64
SHA3-384 hash: 1858fab67aab6131ca89d659a0796eb53377edb472c09afd25a0bd4e99049d31f85eb47d33c0ef7ca92786bce96cb472
SHA1 hash: bb1fb9a180fd1e87c6054d005e0f118ded402226
MD5 hash: 3d8ae9bb3672599187c9b5f0ec8def5a
humanhash: pizza-social-alpha-queen
File name:00108.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:365'339 bytes
First seen:2020-10-08 05:32:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:dYYGDbO+gMjv/gDrz/y2MedJnuoWd4Y8OWnk7ogqUTDyCKxM:kzgSv/iz/rMedJnBmjcOsEtCM
TLSH 3F7423F7E9572E1CD33023F7F2E025680FB5E6E26A77DB1A5A09A80093D9063535533A
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.regr-ocumpo.com
Sending IP: 45.95.169.91
From: "ACC DEP" <info@regr-ocumpo.com>
Subject: BANK IN SLIP
Attachment: 00108.zip (contains "00108.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6300f64cc66cdf1ccb9e954f8c806926d35fca1ce2e5bce5ec28e425251fed64/
Threat name:
ByteCode-MSIL.Trojan.Staser
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 05:15:43 UTC
AV detection:
31 of 48 (64.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mmapmtggntprzs46svhyzadje3jv7sq44ls3zzpmfdsckji75vsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6300f64cc66cdf1ccb9e954f8c806926d35fca1ce2e5bce5ec28e425251fed64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 6300f64cc66cdf1ccb9e954f8c806926d35fca1ce2e5bce5ec28e425251fed64

(this sample)

Formbook

Executable exe a6fd278a82dad870444a8d93e3c05accdfaef779460c2f3777d9ef2441620a41

  
Dropping
MD5 b268f73ab81221c8be2302e09d7f1426
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6fd278a82dad870444a8d93e3c05accdfaef779460c2f3777d9ef2441620a41

Comments