MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83d26c7db3fa6538dfdd5e282e3a3cc943d272a8878e22d8b63852efab706040. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83d26c7db3fa6538dfdd5e282e3a3cc943d272a8878e22d8b63852efab706040
SHA3-384 hash: 5c9b1b1f518ecf12e000b2e87a1b0af1149f7fec745683e709970c99e82856e7ff6cad1a08741699a4da8e5bde7bf73a
SHA1 hash: 83758d0abca12941a519c3e8a59b5293025bc8d3
MD5 hash: 15743ce81dfdcadbd22dcc4a06d89ed5
humanhash: glucose-muppet-red-six
File name:Sample Inv400788.Scan.z
Download: download sample
Signature FormBook
Create hunting rule
File size:550'295 bytes
First seen:2020-10-08 13:13:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+Tt7cQiQNjDO4DKNNSqx7AttOvuDURLWaPtMxKp8:ZQBNjDzmNlIwzRiaPtg+8
TLSH A8C4231DFD0D3783C92167B8D32D7812DA35ACE56E0B5A1AF92384ED4A992C95323C7C
Reporter abuse_ch
Tags:FormBook z


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: vps.shvietnam-vn.com
Sending IP: 45.95.169.113
From: info@shvietnam-vn.com
Subject: Re: Confirm availability of attached Products
Attachment: Sample Inv400788.Scan.z (contains "Sample Inv400788.Scan.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83d26c7db3fa6538dfdd5e282e3a3cc943d272a8878e22d8b63852efab706040/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 06:51:00 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpjgy7nt7jstrx65lyuc4or4zfb5e4viq6hcfwfwhbjo7k3qmbaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/83d26c7db3fa6538dfdd5e282e3a3cc943d272a8878e22d8b63852efab706040

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 83d26c7db3fa6538dfdd5e282e3a3cc943d272a8878e22d8b63852efab706040

(this sample)

FormBook

Executable exe c787057c00b515e2c4c78968650b5978b9b696a9668ee33d82d86a623d5c5752

  
Dropping
MD5 063c607798c41aa1315808c90bd7d4d0
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c787057c00b515e2c4c78968650b5978b9b696a9668ee33d82d86a623d5c5752

Comments