MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccc80b920cf034470729a4a7e25499ff08d30216499b930a13e6a59e8aeb4f53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccc80b920cf034470729a4a7e25499ff08d30216499b930a13e6a59e8aeb4f53
SHA3-384 hash: dbf6cc5a252a8d3ea863a35bc28c7738f33a12a2eb5ae0dcfe35d44c2d8c107cd545b9838a34715297617d51f9671dda
SHA1 hash: d1d85b581aa939c6ee266c4c64dc501bca6d8480
MD5 hash: c723a3b0cfa891285b595e6e13bcd979
humanhash: batman-yellow-mars-princess
File name:Email PO 48762020.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:637'518 bytes
First seen:2020-10-14 15:20:53 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:EGcsr2c5GMFeUdS/Q0acExHaJOGuP54UwA37POFG8ROMXf1b1h1YIdTglzitjj7t:/cc2cUMgUdSI0CNi654Ut7cl1tdUEtjN
TLSH 9AD423A80D3B0B55FF828E3950AB5059C1AFFAA19905513D2FBB0B4F5208C26D1DD6FE
Reporter abuse_ch
Tags:FormBook r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: deltastudweld.com
Sending IP: 103.141.138.124
From: Chani Castillo <chani.castillo@deltastudweld.com>
Subject: PO# 48762020
Attachment: Email PO 48762020.r00 (contains "Email PO# 48762020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccc80b920cf034470729a4a7e25499ff08d30216499b930a13e6a59e8aeb4f53/
Threat name:
ByteCode-MSIL.Infostealer.Stelega
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 07:34:18 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zteaxeqm6a2eobzjust6evez74engaqwjgnzgcqt42sz5cxlj5jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ccc80b920cf034470729a4a7e25499ff08d30216499b930a13e6a59e8aeb4f53

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 ccc80b920cf034470729a4a7e25499ff08d30216499b930a13e6a59e8aeb4f53

(this sample)

Formbook

Executable exe ac9a8babed0c6938fc6a4218376339223faad8ce24cb38497b6377664867b2a0

  
Dropping
MD5 3d45847dcbd62b0468cd56829e4a6ec7
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ac9a8babed0c6938fc6a4218376339223faad8ce24cb38497b6377664867b2a0

Comments