MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e19e0274f7a319919a84162a747b6dd60ce1b2ac45133a2a73d79a8ccf0a7a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e19e0274f7a319919a84162a747b6dd60ce1b2ac45133a2a73d79a8ccf0a7a85
SHA3-384 hash: bd09109762e71cac04ed1ff2564ed475b63f02529368d5cb5b8c8bc2c28b769a8600f58ff4afe092bca25eceefb852e7
SHA1 hash: e694b78125b72320f6cbb5639d28644eed3722e7
MD5 hash: cb18aa2b3ab6db1176c7eac88a17a769
humanhash: stream-music-quebec-mexico
File name:CONFIRM ORDER.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:303'888 bytes
First seen:2020-05-26 10:37:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:WYt678n1Njn0dxk3iTAS02G3X0RwiK3DU9LFvSpFbnJyRnsQ+bA6S8hAj3:WYt67c11noxkSTtGn0RK3+Rczy2QN6SH
TLSH 125423D8288519B52E01C9608CC5A569FE4D3CD3FD6C59186A360AD3BB6293C1EECB39
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Root User <root@localhost>
Subject: RE:RE:ORDER CONFIRMATION
Attachment: CONFIRM ORDER.rar (contains "CONFIRM ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 13:02:59 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar e19e0274f7a319919a84162a747b6dd60ce1b2ac45133a2a73d79a8ccf0a7a85

(this sample)

FormBook

Executable exe e75e9eb97fb635737341ed9fcfd25471fdd9889e75305bbb6b32bbee19b32d52

  
Dropping
MD5 497d3c3fb025b66cde405926f5ed4943
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e75e9eb97fb635737341ed9fcfd25471fdd9889e75305bbb6b32bbee19b32d52

Comments