MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82bde1af689c8f280a4ecebb968e942e51af44773134f26271a380de8c10ec10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82bde1af689c8f280a4ecebb968e942e51af44773134f26271a380de8c10ec10
SHA3-384 hash: bd5a430e412f882ed9f266e75518b0f1566774992abf695ce98e7d30b8e05293e57a88f17423e2750e1528e954a19f32
SHA1 hash: cea6d31421445710c7e3be23d28941d2b3ca479b
MD5 hash: 141964e084179caf7f146d49a61aaf62
humanhash: carpet-moon-hamper-vermont
File name:ORDER9648EABLT.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:640'136 bytes
First seen:2020-10-22 06:50:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:rgCSQx0qi7IL4FgKdrsmF8aubDWbFU8cxmIDBhlLA727WcRWz8mQ8FJZS:VxRMIEusrsm2aWuFU3mIfiOW/5QKXS
TLSH 63D4230406B292690C199DD1DB1F3A9D85428E019BCDAF397C933232F6B6F9EAD4C5D2
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dlveltex.co
Sending IP: 111.90.140.219
From: Michal <Michal@dlveltex.coM>
Subject: Attached selected items and confirmed copy of quotation for your reference.
Attachment: ORDER9648EABLT.rar (contains "ORDER9648EABLT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82bde1af689c8f280a4ecebb968e942e51af44773134f26271a380de8c10ec10/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:17:40 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qk66dl3itshsqcsoz25znduufzi26rdxge2peytruoan5daq5qia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 82bde1af689c8f280a4ecebb968e942e51af44773134f26271a380de8c10ec10

(this sample)

Formbook

Executable exe 3904b8ba4d99b9e8d8b75af02e5d6de0153ef59e5f03d9b30319acbe625ff986

  
Dropping
MD5 34b9e8910d4dae9ac079ac9fcaad3ddc
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3904b8ba4d99b9e8d8b75af02e5d6de0153ef59e5f03d9b30319acbe625ff986

Comments