MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bda3d52c5feb3c6678e67cc5eb965a035895653dfddf1b5dee2823d3d718f27a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bda3d52c5feb3c6678e67cc5eb965a035895653dfddf1b5dee2823d3d718f27a
SHA3-384 hash: 8a4aa4c7acf26e5ab3d49e1ca47849d08c70c39586f1f28861fd8b0e0c60fb889efcbb1342148c88e41e78097645373e
SHA1 hash: 0e0ff7ba8b6222288d8cd09cd1991fed6bdd0cc0
MD5 hash: d48266b35dd646eba5f62811a518ffe5
humanhash: arkansas-alaska-washington-kilo
File name:TP02651432.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:432'341 bytes
First seen:2020-08-11 12:03:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:8o00xhN9DJuFfddd2a52QsTAyKbXRU0lqFKC/pl/FGpWGT9FjX6UBmwGE2L6:q2a7dAaYM8/+n7Gm
TLSH 2D942325943C08D2B17E9EED143786E9531D7CA994F2E029ECC17AD8191FB3C2D463AB
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sonic302-2.consmr.mail.bf2.yahoo.com
Sending IP: 74.6.135.41
From: wellam test-user <t_wellam2@yahoo.com>
Reply-To: t_wellam2@yahoo.com
Subject: HELLO
Attachment: TP02651432.rar (contains "TP02651432.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bda3d52c5feb3c6678e67cc5eb965a035895653dfddf1b5dee2823d3d718f27a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-11 12:05:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwr5klc75m6gm6hgptc6xfs2anmjkzj57xprwxpofar5hvyy6j5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bda3d52c5feb3c6678e67cc5eb965a035895653dfddf1b5dee2823d3d718f27a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar bda3d52c5feb3c6678e67cc5eb965a035895653dfddf1b5dee2823d3d718f27a

(this sample)

FormBook

Executable exe a9d16a92fb274086597cf2d55e5d856fda23d865e763e016f35b5eb1de7c95b6

  
Dropping
MD5 d808197ed48a06911d78d3cd10d29376
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a9d16a92fb274086597cf2d55e5d856fda23d865e763e016f35b5eb1de7c95b6

Comments