MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9bd909614fb85fb9f07195edff3a3ac21949c6443f60cb8e4ecf5fa47d56d21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9bd909614fb85fb9f07195edff3a3ac21949c6443f60cb8e4ecf5fa47d56d21
SHA3-384 hash: 378c6f0f6c1bc4811a60aedcce5dd794df022c6dd67e88e3b391117a439920b2d5b3ecd83a3fe3ab025986d0982986ce
SHA1 hash: aac7ab5273ba5476b9fbbdb9575799121218acc2
MD5 hash: e038797ee2b174f229a0c058ecf196ed
humanhash: march-yankee-four-tango
File name:New Purchase Order 501,689.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:543'456 bytes
First seen:2020-10-15 11:10:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:LkOSfwD7gOpCmU5wPRQlyiLhQMWHUx6I35Bc:LrSf+7VpMSRgyiKuT8
TLSH 49C42325803C602CD606F8E83FF4C5B4AA2A6B56C836BF34C9E56CB458777367939A11
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: sonic308-2.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.130.41
From: shishichuanhao <shishichuanhao@aol.com>
Reply-To: shishichuanhao <shishichuanhao@aol.com>
Subject: Re: Purchase Order Details
Attachment: New Purchase Order 501,689.rar (contains "New Purchase Order 501,689$.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9bd909614fb85fb9f07195edff3a3ac21949c6443f60cb8e4ecf5fa47d56d21/
Threat name:
ByteCode-MSIL.Spyware.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-15 02:55:27 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vg6zbfqu7oc7xhyhdfpn745dvqqzjhdeip3azohe5t27ur6vnuqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a9bd909614fb85fb9f07195edff3a3ac21949c6443f60cb8e4ecf5fa47d56d21

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar a9bd909614fb85fb9f07195edff3a3ac21949c6443f60cb8e4ecf5fa47d56d21

(this sample)

Formbook

Executable exe 1aa1c6c264025cc567e70f6ca867a0c6618bd2eb2ec3312730c68a41c0d7e076

  
Dropping
MD5 2780354dbc816edef9490878ec9425d9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1aa1c6c264025cc567e70f6ca867a0c6618bd2eb2ec3312730c68a41c0d7e076

Comments