MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48e5e88ad1e591e8e26a5fbf27551382c8c55f0e272a5e40f26e73a2885ccb21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48e5e88ad1e591e8e26a5fbf27551382c8c55f0e272a5e40f26e73a2885ccb21
SHA3-384 hash: 0043abfeec2e779983ac810c18989b8c341a8b6cf587efc3fa62ba6e0450110a926a982698f5a273082a2f55afb051b9
SHA1 hash: c6ec0d6487dd7b00615d2c96c6c7a65524a8a0c4
MD5 hash: a478eea43fd932b1467566ede50126a7
humanhash: mango-minnesota-freddie-kitten
File name:PO894749745.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:295'554 bytes
First seen:2020-07-07 09:43:44 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:bXDFpDL1u3b2RCoaq+IZlxtAFTh6b2v3+krXM2B3C1KejoZYvQE+J:/FpDa6CoaLIZlch1dJC0ejQYvGJ
TLSH 0954230D62192CE1FA33EA0AB971C78E7145D898434EF73B8250A676F33E131B159C7A
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: regular1.263xmail.com
Sending IP: 211.150.70.203
From: Julie <cjianh@bak.com.cn>
Subject: PO894749745
Attachment: PO894749745.zip (contains "PO894749745.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48e5e88ad1e591e8e26a5fbf27551382c8c55f0e272a5e40f26e73a2885ccb21/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 09:45:14 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jds6rcwr4wi6rytkl67sovitqlemkxyoe4vf4qhsnzz2fcc4zmqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 48e5e88ad1e591e8e26a5fbf27551382c8c55f0e272a5e40f26e73a2885ccb21

(this sample)

Formbook

Executable exe b258aed05413eb191250d2907db5b64c4f36fdb0508fb3c9c6390c4144fd9497

  
Dropping
MD5 6d687e89130f81088fcbf8f302700c1b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b258aed05413eb191250d2907db5b64c4f36fdb0508fb3c9c6390c4144fd9497

Comments