MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a9baaf81226b729c1b5d5fcf48d3abdf586e9f11adea4a8ced633f59f31a03c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a9baaf81226b729c1b5d5fcf48d3abdf586e9f11adea4a8ced633f59f31a03c
SHA3-384 hash: a357f14bfb62bef3316583fbbc202c01ce69d89b084d0e59ce59d328be0016cbfc7e91c8fb3535651c750a19ba144c5e
SHA1 hash: 3ec2239c47830ff8d4ab1cc3065703c6326632b8
MD5 hash: 64613ffe1500bd89504bcbadf7b0d706
humanhash: echo-oklahoma-oklahoma-vermont
File name:Quotation.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:318'741 bytes
First seen:2020-07-07 08:49:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:Y07CiWRuDlzPI99p5HwUqydq4e9PzJqIbFvaAOs:Ije945Qfyk4e9PzAIbF3z
TLSH 7C642331CF3C62EA83764BF72243857DEBA9310DC2C8FF4E62E9D85668D46709A2D055
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: slot0.olyatise.com
Sending IP: 45.95.169.159
From: info@olyatise.com
Attachment: Quotation.rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a9baaf81226b729c1b5d5fcf48d3abdf586e9f11adea4a8ced633f59f31a03c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 08:51:06 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkn2v6ase23stqnv2x6pjdj2xx2yn2prdlpkjkgo2yz7lhzrua6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 5a9baaf81226b729c1b5d5fcf48d3abdf586e9f11adea4a8ced633f59f31a03c

(this sample)

FormBook

Executable exe c2221b7f65afde44bb459fec37286e4ad1f032d30be34d04527497c4b6acfdbd

  
Dropping
MD5 35890d210ae3539ce3cf24f730d186d5
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c2221b7f65afde44bb459fec37286e4ad1f032d30be34d04527497c4b6acfdbd

Comments