MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd71538b37fe0e2af9be2f15266c30103b697c12ea59b65acab1275b9e4fcdc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd71538b37fe0e2af9be2f15266c30103b697c12ea59b65acab1275b9e4fcdc6
SHA3-384 hash: 068a8cf44b3029d18d5d4301ca6d3987e7c34b63a3d788aeb71e14849419ca71019ee235a43c3f0b5075b9f48e732ee1
SHA1 hash: 0d95f22c06de406ee510832bfb59ac1a65c478a4
MD5 hash: b1553027b2229cb3c0da8c4e854a6afa
humanhash: wolfram-blossom-india-texas
File name:PO131020.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:663'561 bytes
First seen:2020-10-13 10:35:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:5vibpMfk8dZJRQ8IjBck7sUkOsNXeQJLq8x1dmyTBfd/z8xFMQgU:5viGjZJyRjBLkOx6bNR8xFXgU
TLSH 64E423A8DD5A3BE2CF807FEE3F3BA10694C42F8C848DCA57EE71941E47E01525746229
Reporter abuse_ch
Tags:FormBook Rackspace rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: smtp84.iad3a.emailsrvr.com
Sending IP: 173.203.187.84
From: Peter Botha <huffmanl@realtracs.com>
Subject: Purchase Order
Attachment: PO131020.rar (contains "JBAEKUa4mQ5eVCw.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd71538b37fe0e2af9be2f15266c30103b697c12ea59b65acab1275b9e4fcdc6/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 04:36:44 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xvyvhczx7yhcv6n6f4ksm3bqca5ws7as5jm3mwwkwetvxhspzxda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bd71538b37fe0e2af9be2f15266c30103b697c12ea59b65acab1275b9e4fcdc6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar bd71538b37fe0e2af9be2f15266c30103b697c12ea59b65acab1275b9e4fcdc6

(this sample)

Formbook

Executable exe 73c2d8d44daa16a7b406b82cd5201483ae40404037e7a543ad91689cbced81ad

  
Dropping
MD5 59e4602aa9f49d8e5624d0809f45da8f
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 73c2d8d44daa16a7b406b82cd5201483ae40404037e7a543ad91689cbced81ad

Comments