MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 452b8b19795a4edf08bf56f7c446d1af5963b520f4d6d93776ef7fe935c2c471. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 452b8b19795a4edf08bf56f7c446d1af5963b520f4d6d93776ef7fe935c2c471
SHA3-384 hash: e7f68e70fd6c3c1c699b14a4e749112e419bf8fab480025d6f5563d764212c2aa82b462206ae1e8fa2ab827f7060ec91
SHA1 hash: cf9ddb6eeabc478bea5aed8123f0f90d9d2635ab
MD5 hash: 980bd2170ed50afe7c10040a1e3ede69
humanhash: foxtrot-vegan-india-fourteen
File name:CREDIT NOTE.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:298'124 bytes
First seen:2020-07-22 08:34:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:4CRl6XkrcQ+/wfNMt/QvN3a2GdfPaBiybC6+dp7dwfZk3nbWe5juX:vRlNv/fOtuq2GgzbCr7+G3/5A
TLSH E854234C0544C2AA5DDED477A72BF0FC732F92CEBAD564A3339D390D2644A8442A3AC7
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dongsonvina.co
Sending IP: 111.90.145.114
From: Jennifer Smith <jennifer.smith@hysic.co>
Subject: RE: AW: Order sheet/credit note
Attachment: CREDIT NOTE.rar (contains "CREDIT NOTE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/452b8b19795a4edf08bf56f7c446d1af5963b520f4d6d93776ef7fe935c2c471/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-22 08:36:06 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iuvywglzljhn6cf7k334irwrv5mwhnja6tlnsn3w5576snocyryq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/452b8b19795a4edf08bf56f7c446d1af5963b520f4d6d93776ef7fe935c2c471

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 452b8b19795a4edf08bf56f7c446d1af5963b520f4d6d93776ef7fe935c2c471

(this sample)

FormBook

Executable exe 3e58111450129327ec78aca888dade3083b188f92d21934a2c1104a5b5c0a9f3

  
Dropping
MD5 4b6dbebda46381a3a9062e690102669f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3e58111450129327ec78aca888dade3083b188f92d21934a2c1104a5b5c0a9f3

Comments