MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfcb13ce9e21790b5f25d0d51c6e300c019956eda03f6d41ab857f9eae8e3a68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfcb13ce9e21790b5f25d0d51c6e300c019956eda03f6d41ab857f9eae8e3a68
SHA3-384 hash: 033af09ff2aebc508cf30b9a408e75db07ffeb074a949516812334f6f7c30922a080dde747d8d2a2829b4e3085acb1dd
SHA1 hash: aa9e8022b540506a733c8b01dc95aa291e18a428
MD5 hash: ceb5155bffb5faaedefcfba3a3f76d95
humanhash: berlin-delaware-mockingbird-rugby
File name:DHL AWB_16062020.IMG
Download: download sample
Signature FormBook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-16 05:08:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:8Gye+qLK4ey3++/rBYOGahDwCAU0vzwakjesotHBlZFXg4oz4FP:8GyeM4ee/2Ors5LwzSsotHBlZFXg8J
TLSH 3A45F12CA28C8362C67D077984E1112043F97D663533E65E7E8C31BA6FB37E556326A3
Reporter abuse_ch
Tags:DHL FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: antispam3.ctm.net
Sending IP: 125.31.5.76
From: Zhen Xing Yang (DHL) <yzx@macau.ctm.net>
Subject: DHL Express Tracking No. 7177009070.
Attachment: DHL AWB_16062020.IMG (contains "DHL AWB#16062020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.6b9b5f5019a647d3.27071.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:10:13 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7frhtu6ef4qwxzf2dkry3rqbqazsvxnua7w2qnlqv7z5luohjua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img cfcb13ce9e21790b5f25d0d51c6e300c019956eda03f6d41ab857f9eae8e3a68

(this sample)

FormBook

Executable exe 972dbabdb87df7e564d3b5162d94d22ccb326a6f6d2150f3a9b29bc32e8feb32

  
Dropping
MD5 6b9b5f5019a647d3366671280ebd5608
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 972dbabdb87df7e564d3b5162d94d22ccb326a6f6d2150f3a9b29bc32e8feb32

Comments