MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc5808e90a1540e8f2523f7f0e072d7d91d527e68cd50e4caaa98cbbe1988819. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bc5808e90a1540e8f2523f7f0e072d7d91d527e68cd50e4caaa98cbbe1988819
SHA3-384 hash: e327a918f827c667b25acee88f60753c6504b2a497548f498c52ae0f9806cbc4d2da2598aef7c57401ef5cc0c24478d9
SHA1 hash: 71927f4e9a855bbe179737a9a050d4233240ce7f
MD5 hash: d921a212c9cd066df391374b26304466
humanhash: potato-river-north-tennis
File name:shipping documents, INV+BL.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:386'892 bytes
First seen:2020-07-31 05:53:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:IvyskMeAv9Y5o8tg/J7bVYwVSk3khvxFgNMHWddmlkAdRqhBwiGtH9agahDpIIm8:BzDAFUg/J7bV9Vh3kEMHodIxdRuGhsgc
TLSH 7F84236E008F71A94EF83C105B82473D62F2AF98735FB06B95BD0117544A7D82E8AFD6
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dhl.com
Sending IP: 37.49.224.193
From: DHL Express Service <no-reply@dhl.com>
Subject: DHL Shipment Arrival Notification victim-email
Attachment: shipping documents, INV+BL.zip (contains "shipping documents, INV+BL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bc5808e90a1540e8f2523f7f0e072d7d91d527e68cd50e4caaa98cbbe1988819/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 05:55:06 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xrmar2ikcvaor4ssh57q4bznpwi5kj7grtkq4tfkvgglxymyramq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/bc5808e90a1540e8f2523f7f0e072d7d91d527e68cd50e4caaa98cbbe1988819

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip bc5808e90a1540e8f2523f7f0e072d7d91d527e68cd50e4caaa98cbbe1988819

(this sample)

FormBook

Executable exe 5e1663a897c64460d68fdf6848b63f589680e75f4d935258a7862b9d1ff617b1

  
Dropping
MD5 528803eb79a155fc433c390a194ae344
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5e1663a897c64460d68fdf6848b63f589680e75f4d935258a7862b9d1ff617b1

Comments