MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec1f2cd0093c18f5993ddd14762bb882aeeb06c70199b582b4393c1936ca0198. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec1f2cd0093c18f5993ddd14762bb882aeeb06c70199b582b4393c1936ca0198
SHA3-384 hash: 277b1944f0f81c2e702e5bf843217b4b5cac5eac84d1e1bf7c3d067424c82e39545e5cc4f8f0f08a2fa9b06e2d007d68
SHA1 hash: 370632b4709abea103ac1dcc79ab21c73e3d598e
MD5 hash: cfe876e04bdc169a35b70e6437fea8d5
humanhash: sweet-artist-comet-sodium
File name:Vessel details.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:895'851 bytes
First seen:2020-08-05 07:52:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:R7an82I1sY4BtQT0vFOE2p9Zo8Q1QnavjgVHuwpvTAPNNZ:RiRe6BtQAvFOEuDo8Q1E/VHPvEp
TLSH BE1523102F098639B3ACA01527BBE72946D1F4FC194F5C1DB783E04237F6EAE9D91658
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: mail.esipooaintl.cf
Sending IP: 161.129.67.157
From: Huang Biyu <biyu.huang@sg.wilmar-intl.com>
Subject: MV PRINCESS SUZAN - AGENCY NOMINATION /DISCHARGING
Attachment: Vessel details.zip (contains "Vessel details.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec1f2cd0093c18f5993ddd14762bb882aeeb06c70199b582b4393c1936ca0198/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:54:10 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5qpszuajhqmplgj53ukhmk5yqkxowbwhagm3lavuhe6bsnwkagma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ec1f2cd0093c18f5993ddd14762bb882aeeb06c70199b582b4393c1936ca0198

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip ec1f2cd0093c18f5993ddd14762bb882aeeb06c70199b582b4393c1936ca0198

(this sample)

FormBook

Executable exe d826e50de7b11772bc48d32d0f75b72a7975e469cfe9583a51edbd9bbaa58387

  
Dropping
MD5 3cde6dd23395bf36602aeb3c8aab463f
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d826e50de7b11772bc48d32d0f75b72a7975e469cfe9583a51edbd9bbaa58387

Comments