MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c46ee625d9626c6583f1129a66c6044d50ae10ba95fec689e13646a0278afbe0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c46ee625d9626c6583f1129a66c6044d50ae10ba95fec689e13646a0278afbe0
SHA3-384 hash: 77e1d803555a898b08f1f1fcf26af6f0b0c3b96a598c8aa00bc07ae6913b5fef609583b2032182918867675731de21e2
SHA1 hash: a47251a438dbbf3db0d80d760748b51dcb3222a0
MD5 hash: 52f8f77ad3645ad1ff87f005b6a8fc14
humanhash: tennessee-beer-kentucky-may
File name:Templates.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:1'382'586 bytes
First seen:2020-08-10 08:46:12 UTC
Last seen:2020-08-10 09:56:56 UTC
File type: zip
MIME type:application/zip
ssdeep 24576:AW5TEND2MnXdNAFF1QoN6Pbb/lj3LbD402HNFF1euJWAqLmyw7SThtplZCU6YqJ5:AW5oNDNXduX176H/l7Lbc02trnW+STxk
TLSH 4E553344B3AFD54DDA02A100C2FB46F205B33BE09BDE843696F5D9C50A667486D35E2F
Reporter abuse_ch
Tags:AgentTesla FormBook Hostwinds zip


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: hwsrv-761317.hostwindsdns.com
Sending IP: 104.168.173.112
From: info@ricksaezp.com
Reply-To: info@ricksaezp.com
Subject: Quote#CON-071720-EB
Attachment: Templates.zip (contains "Packing.scr")

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.43632064.15304.26823.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c46ee625d9626c6583f1129a66c6044d50ae10ba95fec689e13646a0278afbe0/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 08:48:10 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yrxomjozmjwgla7rckngnrqejvik4ef2sx7mncpbgzdkaj4k7pqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Starter
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c46ee625d9626c6583f1129a66c6044d50ae10ba95fec689e13646a0278afbe0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip c46ee625d9626c6583f1129a66c6044d50ae10ba95fec689e13646a0278afbe0

(this sample)

AgentTesla

Executable exe a17afb19461b7a3a23576250e3fe3a3970afa5a143167fe97e97aeadcd9705d4

  
Dropping
MD5 aca270dcb0654e6e0480cb2287934969
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a17afb19461b7a3a23576250e3fe3a3970afa5a143167fe97e97aeadcd9705d4
  
Dropping
SHA256 d7740644db0391caebce4ec75e92a95062eb29b65cf118815907ae1a291421a1
  
Dropping
MD5 6b693ec92fa73a62acad9332bbf4b00e
  
Dropping
SHA256 1ac93b118f2f6facc20288611532e4f0f898967e262a6c9cea66bc2da07ad732
  
Dropping
MD5 208671e3fc9131fb1f9d0676d58ec5a8

Comments