MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4c367fe30bffbc9e26f47c7f29c0297891df2077b08e6d2fbe84370c22a7455. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4c367fe30bffbc9e26f47c7f29c0297891df2077b08e6d2fbe84370c22a7455
SHA3-384 hash: d042bf3c7c10f42eaa3209c58c3096af2274e4a3aa5766df2d4d57d06c8fd1fe03002d2acf5bb5cb9205c98242478a7e
SHA1 hash: af35735b2a284c3c9edc01b406a82b803b493a63
MD5 hash: e274b09d07fee73987f53793741acc82
humanhash: cat-winner-chicken-utah
File name:New POs P25366 KS20044 P25360 KS20043.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:277'108 bytes
First seen:2020-06-16 05:41:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:eraejO+qadXZEIFBWiNVZ7qObT21GtPW6ZYTS07NFk9:erJqaVZtB/3xD+GtPee7
TLSH DC442321F58999AD039041E64FAAD13EF47C5E7C8A924E24D57CF29AA5EC707BC20E43
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sungwon7.co
Sending IP: 111.90.158.36
From: Pepe <pepe@sungwon7.co>
Subject: Re: RE: New POs P25366 (KS20044) & P25360 (KS20043)
Attachment: New POs P25366 KS20044 P25360 KS20043.rar (contains "New POs P25366 (KS20044) & P25360 (KS20043).exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:43:05 UTC
AV detection:
13 of 28 (46.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ytbwp7rqx754tytpi7d7fhacs6er34qhpmeonux35bbxbqrkorkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar c4c367fe30bffbc9e26f47c7f29c0297891df2077b08e6d2fbe84370c22a7455

(this sample)

FormBook

Executable exe 3a623059d68483ec267fb4852e1209eb93c3f351ba976cc1ef92da7070c33c64

  
Dropping
MD5 0012022d198110853386603a474d41b4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3a623059d68483ec267fb4852e1209eb93c3f351ba976cc1ef92da7070c33c64

Comments