MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13e92d1d6b77af965a828a921c01271c36e2fb38ad037bfab38a3943087a68dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13e92d1d6b77af965a828a921c01271c36e2fb38ad037bfab38a3943087a68dc
SHA3-384 hash: a1f5560459914cd9b84da57782a0aa636076cd7d9f456d66a04b6c938f90deecc48699d70b9da7559a2dffec47f5281c
SHA1 hash: 985358d65409ec575be10827c412aef1ab224f17
MD5 hash: ce162bffcceeddbc8296207f2d0b9b47
humanhash: violet-undress-east-maryland
File name:RFQ-QUOTATIONJULY2020.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:283'062 bytes
First seen:2020-07-06 06:32:18 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:iW7AzmQ3W8LZQ0FwLOlrlGjlj16EjgE3TmoL9Z4WLrU1wfOsjVv1Dmy:TQRL/Dhg5QEjfBBnDjV9Dmy
TLSH 4B5423647842F6F8386A7FB7E45473FE8E0056B7057B0AEFB94EB086A207140DBA551C
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dlveltex.co
Sending IP: 111.90.145.49
From: Cona Import Company <operacional26@conaimport.com.br>
Reply-To: david@kelichna.com
Subject: RE:RFQ-QUOTATION#JULY2020
Attachment: RFQ-QUOTATIONJULY2020.rar (contains "RFQ-QUOTATION#JULY2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13e92d1d6b77af965a828a921c01271c36e2fb38ad037bfab38a3943087a68dc/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 06:34:06 UTC
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cpus2hllo6xzmwucrkjbyajhdq3of6zyvubxx6vtri4ugcd2ndoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 13e92d1d6b77af965a828a921c01271c36e2fb38ad037bfab38a3943087a68dc

(this sample)

FormBook

Executable exe 154d6b81bf4dcce3911f5c72f4790569e1cd91aee0040e7c1341f5286952bafe

  
Dropping
MD5 2a59c4d9b6c5438bc5cd69d8768c8035
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 154d6b81bf4dcce3911f5c72f4790569e1cd91aee0040e7c1341f5286952bafe

Comments