MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 670dad8ea526fa9054b34d85aa1b4f539e54ae75aba530b6bfb5b97a4ec08aaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 670dad8ea526fa9054b34d85aa1b4f539e54ae75aba530b6bfb5b97a4ec08aaf
SHA3-384 hash: 4dbb900eb391096f2e9e87fd62ba0dfafe84292aec328fc98a7f1f353d5d0e79feb25ea9f324f6ca1c90a56816682ef0
SHA1 hash: f3581502a2134eefa76b52cc537d92a7e5e15fc3
MD5 hash: ce6459d89c946ba807ab4db4ef07c071
humanhash: nuts-mango-network-illinois
File name:shipping doc, INV+BL.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:220'634 bytes
First seen:2020-08-03 07:44:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3072:+8CaZjjlpSkCcnN6F9nYJdlbbGQXAXVUfLEZhQziApO82Tfx37wf9CO+E:LCaFh+F9YblmQMGLnzNphyxLwfoOF
TLSH 0D2423A87E159F094D880FE25DED990591EEBBCF17AD9622EF2CD07224141C3837A476
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: dhl.com
Sending IP: 37.49.224.193
From: DHL Express Service <no-reply@dhl.com>
Subject: DHL Shipment Prealert Arrival Notification victim-email
Attachment: shipping doc, INV+BL.zip (contains "shipping doc, INV+BL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42523.8106.32082.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/670dad8ea526fa9054b34d85aa1b4f539e54ae75aba530b6bfb5b97a4ec08aaf/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-02 14:51:34 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=m4g23dvfe35javftjwc2ug2pkopfjltvvostbnv7ww4xutwarkxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/670dad8ea526fa9054b34d85aa1b4f539e54ae75aba530b6bfb5b97a4ec08aaf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 670dad8ea526fa9054b34d85aa1b4f539e54ae75aba530b6bfb5b97a4ec08aaf

(this sample)

Formbook

Executable exe 506381110aba86052e5ddfa191dffe2e533c8be5cd6f7104b96ba642aa038fed

  
Dropping
MD5 c396c73997d8c1716df90f43959d23a7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 506381110aba86052e5ddfa191dffe2e533c8be5cd6f7104b96ba642aa038fed

Comments