MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c322a905275e7374bf16017af4c56606231b5475247b44b587d8fbae947ded1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c322a905275e7374bf16017af4c56606231b5475247b44b587d8fbae947ded1
SHA3-384 hash: 72b7bab3afb29d3f5c04b504c7bf801252ae31559be89ca752c0b2bca91e24445381eb612a19f6784984f3acb12a6b7e
SHA1 hash: 2d85de190c9e054e56aeeeda41039b9f8506f3b2
MD5 hash: 829e7bdc7e66676c0215ff5ac7d38982
humanhash: fifteen-blue-football-pluto
File name:PO_4684_JUN12.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:273'728 bytes
First seen:2020-06-15 13:09:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:OAoy7NBCM9JlyiOOSCRzYDnKbufQPPrWgVFJ+8gwkcSs7RlnZ:OWjCMXlyiOsRzYDnKbuoPDWqmRwk3s7V
TLSH 674423E039C4C6FD630275C67EE770CB52023867F3449AACF6B51D2E1B6A4B29660ED4
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail0.gimaonetiniori.icu
Sending IP: 139.59.70.150
From: Adrian Tan <karen.lee@gimaonetiniori.icu>
Reply-To: eterecomo@eternalexposure.com.my
Subject: 回复：Invoice :Purchase Order
Attachment: PO_4684_JUN12.zip (contains "PO_4684_JUN12.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 13:10:05 UTC
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hqzcvecsoxttos7rmal26tcwmbrddnkhkjd3is2ypwh3v2kh33iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 3c322a905275e7374bf16017af4c56606231b5475247b44b587d8fbae947ded1

(this sample)

FormBook

Executable exe 79ed25d14bd82eed48aae26c3ea3d4e6a334774296d2189832551ddb57abbafc

  
Dropping
MD5 8dddf09e0b83945e3cfc79506e5c9132
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 79ed25d14bd82eed48aae26c3ea3d4e6a334774296d2189832551ddb57abbafc

Comments