MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b41bc327c153b132623ccb82efc519e56065661945e9701d1a7e748a560dc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5b41bc327c153b132623ccb82efc519e56065661945e9701d1a7e748a560dc0
SHA3-384 hash: a582d637a8a60eef4e20a7c9b82063986ae27a122f1bcd2fc786861a773a7586d4fb634c94c9c82582a38fe9e2d8ac1d
SHA1 hash: 01a5457c90b46ac25b589821605af24020e976d0
MD5 hash: 686659d4dda78bf5531850bb92361023
humanhash: rugby-black-fifteen-burger
File name:New order for august.7z
Download: download sample
Signature Formbook
Create hunting rule
File size:595'149 bytes
First seen:2020-08-12 09:56:58 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:h2QIlmVDfcGGTnpI3BALFu6hZOaTg5g1L07uI3ooswXWNJ7:h5IgZftgnpKZuEaTgcL0nnXW7
TLSH 11C4235A262C2C71AD1779C0B69F330C74C4A48D7F5A2546B0BDCF27BA408F65A6B9E0
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email
From: Purchasing <dorothy@elwood.cf>
Received: from cojix.com (unknown [45.127.62.16])
Date: Tue, 04 Aug 2020 13:47:56 +0000
Subject: new order for august
Attachment: New order for august.7z

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen10.845.28922.13534.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5b41bc327c153b132623ccb82efc519e56065661945e9701d1a7e748a560dc0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 15:48:19 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5b41bc327c153b132623ccb82efc519e56065661945e9701d1a7e748a560dc0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

7z d5b41bc327c153b132623ccb82efc519e56065661945e9701d1a7e748a560dc0

(this sample)

Formbook

Executable exe 7a65842e4b600e556b4373b55c29508315f3b3acea33075e32d380f6ae606392

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a65842e4b600e556b4373b55c29508315f3b3acea33075e32d380f6ae606392

Comments