MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d62919f71bd2fc398555e5aa042070affd3f331c21e9354a371689c43206330. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d62919f71bd2fc398555e5aa042070affd3f331c21e9354a371689c43206330
SHA3-384 hash: bb3c931e06cbca29439d11a82adf78c5132a5cef165e3d81fb4e566046ecddbf8a6e4b70a80b10b1d0a75afb797bba9a
SHA1 hash: 0a42dc6958279a697ca2cdc88a0ce921b152cb48
MD5 hash: 22ce91e9110d21e976c9a1d82fd968e3
humanhash: delaware-chicken-william-black
File name:New Doc Payment Confirmation_PDF.r09
Download: download sample
Signature FormBook
Create hunting rule
File size:292'457 bytes
First seen:2020-07-01 08:42:55 UTC
Last seen:Never
File type: r09
MIME type:application/x-rar
ssdeep 6144:kpjJGDHX18Hi/P5F3elZy6hR/JOIORtyh2Hi7KGP/6:kpjqyYP5FOq6hRkNvyh2Hi7p/6
TLSH 5D54236563ED351E0D907CE9B71372B82D132EF273DA52241D06AE1252AC1B26CBCF66
Reporter abuse_ch
Tags:FormBook r09


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: multisecurities.com
Sending IP: 103.125.191.31
From: Accoounts <customercare@multisecurities.com>
Subject: Payment confirmation
Attachment: New Doc Payment Confirmation_PDF.r09 (contains "New Doc (Payment Confirmation)_PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d62919f71bd2fc398555e5aa042070affd3f331c21e9354a371689c43206330/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-01 08:44:05 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvrjdh3rxux4hgcvlznkaqqhbl75h4zryipjgvfdofujyqzammya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

r09 7d62919f71bd2fc398555e5aa042070affd3f331c21e9354a371689c43206330

(this sample)

FormBook

Executable exe 4e8ddcec5c75934d0418b3f5f66c20925bd67b6acda0bb0c3a0ee684865a6e4b

  
Dropping
MD5 4f4b81b898333d4e1729cdfd63ae4dde
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e8ddcec5c75934d0418b3f5f66c20925bd67b6acda0bb0c3a0ee684865a6e4b

Comments