MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d4b447cd683c9551f780d5da0f8591446a845a8059f630fb792e4c2697401ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d4b447cd683c9551f780d5da0f8591446a845a8059f630fb792e4c2697401ce
SHA3-384 hash: d1245cf3611d9b59b4ef55105c24d32d0cf0d55b0def11f5db1c5154fd5d4d064625e63eb741ca7fdde97d8e112cf118
SHA1 hash: 417c48a34113a09f36b7ff67901cd78e2828e885
MD5 hash: 31ce3c087864a2ab3b83bce8b3f03a3d
humanhash: nebraska-carpet-william-speaker
File name:quote-THP1403 080620.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:328'945 bytes
First seen:2020-07-07 08:52:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:q0gerVbbmWRT+wFotrx+RVOj3GOeFQg+FAkN3jy8Uowo:q7eptYBtrx8Oj3GOeF+2ajool
TLSH 32642338A5286DBE8944D98F4CFB9D6CC5BD99C6801A63211DA5F5BDDD880C81E330BD
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-748566.hostwindsdns.com
Sending IP: 104.168.155.2
From: Dat-tH company <sr@grandtek.pw>
Reply-To: Dat-tH company <mahdi_bashii45@yahoo.com>
Subject: Please quotation for valves / RFQ no. THP1403 080620
Attachment: quote-THP1403 080620.zip (contains "quote-THP1403 080620.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d4b447cd683c9551f780d5da0f8591446a845a8059f630fb792e4c2697401ce/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 08:54:05 UTC
AV detection:
33 of 48 (68.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvfui7gwqpevkh3ybvo2b6czcrdkqrniawpwgd5xslsme2luahha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 2d4b447cd683c9551f780d5da0f8591446a845a8059f630fb792e4c2697401ce

(this sample)

FormBook

Executable exe c327cc4c54ba20e649ab27c83ea7d5fcf2a596ae3f9feb50b2f5d550bcb71bf8

  
Dropping
MD5 04e9512a58cc579f1a304cf851c26953
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c327cc4c54ba20e649ab27c83ea7d5fcf2a596ae3f9feb50b2f5d550bcb71bf8

Comments