MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc08e8d77f12b99a1fb9c7c511cc442a0ddbf5f85625e2cd6fc236e2301c9be0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc08e8d77f12b99a1fb9c7c511cc442a0ddbf5f85625e2cd6fc236e2301c9be0
SHA3-384 hash: de6be39e9bba3e33ad3120302f1c70e75356a71c8df9b1e084d991eff663e26a65a7951a55115a7b60d4a2547065c250
SHA1 hash: 819f45004f095816378cd6b59b82e52fb85bd795
MD5 hash: 44d2642b3beeccd1b11ce3a4313d6e6e
humanhash: sierra-blossom-may-cup
File name:img-602105445-0001.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:876'211 bytes
First seen:2020-08-05 09:20:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:C0uiT7ASPdnHV9A8cDliA81IhcWnoYyzON0KGFFOeAVR4Al1pJwDRaKbICuiSimB:oe7lFHV3Q8ucsnyzO+mBdCDRDi7qKf
TLSH B31533C73C89F011A384DC3C4EB82B917F5B20BA54935E305375E612AE9933D6FA5E46
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: nsl5.hosthane.com
Sending IP: 217.116.192.24
From: MTEX NS | Printer <impressora@mtexns.com>
Subject: MTEX NS | Scan from printer
Attachment: img-602105445-0001.zip (contains "img-602105445-0001.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc08e8d77f12b99a1fb9c7c511cc442a0ddbf5f85625e2cd6fc236e2301c9be0/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:02:25 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xqeorv37ck4zuh5zy7crdtcefig5x5pykys6ftlpyi3oema4tpqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bc08e8d77f12b99a1fb9c7c511cc442a0ddbf5f85625e2cd6fc236e2301c9be0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip bc08e8d77f12b99a1fb9c7c511cc442a0ddbf5f85625e2cd6fc236e2301c9be0

(this sample)

FormBook

Executable exe 9aad58f1d569335bb140604794a5b3e2f02fd44ebbfc16e86b795b93f460e98c

  
Dropping
MD5 85bf9189f1220e310d0d5626d7ca286c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9aad58f1d569335bb140604794a5b3e2f02fd44ebbfc16e86b795b93f460e98c

Comments