MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29a2494b73b9775e4dbaa708d8584f1ce1e6aae6c49d5589b18dbe066e4cb708. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29a2494b73b9775e4dbaa708d8584f1ce1e6aae6c49d5589b18dbe066e4cb708
SHA3-384 hash: 5f920f3af7a05accb7cd04c03db5385726e475d7feac0a4187711a6c5fad61388ab763afeaa68e9378efe39eb0043238
SHA1 hash: 6faa2e2d6b0ecbd8fc625e1ae106d2d1eec513af
MD5 hash: 753f76dc719b6be39f1cf6ff22dd210f
humanhash: jig-minnesota-solar-bluebird
File name:ORDER INQUIRY.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:251'208 bytes
First seen:2020-05-25 08:35:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VjFIsKfsxM0mc247yJUmMZYc4XyTFaSWtZo:BGNfsxN22ybMZcyTFtL
TLSH BB342311E359D318181F9364939E9870141D6C89E9ED52AE333C9D8F9FB30B721AE792
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: SAMIULLA NAKWA <s.nakwa@qualitech-solutions.cam>
Subject: URGENT ORDER INQUIRY
Attachment: ORDER INQUIRY.rar (contains "ORDER INQUIRY.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 09:36:08 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
15 of 48 (31.25%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 29a2494b73b9775e4dbaa708d8584f1ce1e6aae6c49d5589b18dbe066e4cb708

(this sample)

FormBook

Executable exe 27379cbd39dae5d145ff292ffd71387a5508bba83997177272742b486cb4e662

  
Dropping
MD5 6bd95e18dbd55ab2bb32d2bdef0c88e6
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 27379cbd39dae5d145ff292ffd71387a5508bba83997177272742b486cb4e662

Comments