MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c2cbc8b3f0efbabb281cb15fa0d08b2b805dddfa8028b285e795c6b6ecdda02. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c2cbc8b3f0efbabb281cb15fa0d08b2b805dddfa8028b285e795c6b6ecdda02
SHA3-384 hash: 82cbde8cc49d2a4a6d034ad5176ef6d9291d33ad70a791068b1b846f3e76b1fae07dc3d48b1cb95855a691c5a8f0f034
SHA1 hash: 9f83248171dc6312da7fb9afb11b488d49518a2c
MD5 hash: fb7b6207d6b7643f9279a7fc2e6ba6a9
humanhash: black-nuts-queen-johnny
File name:PO102.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:315'050 bytes
First seen:2020-07-29 11:16:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:U0IIwceM1kvNlyliik68h12nG+a8TgwitFzBHNLY+alYsOQwtnydisQmpD7eQc:UDM2vNlaiVG1a8TgwwY0PsN4P
TLSH C364239642BB3770E126ED20B52817297F1F080FF3D918BCD0B55ED2EA40B77C966982
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

From: arif@ozanadolu.com
Subject: NEW PURCHASE ORDER FROM GANGWAL CHEMICALS PVT LTD
Attachment: PO102.rar (contains "PO102.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c2cbc8b3f0efbabb281cb15fa0d08b2b805dddfa8028b285e795c6b6ecdda02/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:18:16 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nqwlzcz7b352xmubzmk7udiiwk4alxo7vabiwkc6pfogw3wn3iba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6c2cbc8b3f0efbabb281cb15fa0d08b2b805dddfa8028b285e795c6b6ecdda02

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 6c2cbc8b3f0efbabb281cb15fa0d08b2b805dddfa8028b285e795c6b6ecdda02

(this sample)

FormBook

Executable exe 548f6937985adb04cce6bda4127f3d2af247feada21eda348d1d6a0e8dd7d2c7

  
Dropping
MD5 544f97d08c44accf6feb140704686ad9
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 548f6937985adb04cce6bda4127f3d2af247feada21eda348d1d6a0e8dd7d2c7

Comments