MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f974e877c025cf6a6127731510dfad877fe9cd15093ccc5f76cbc1d626b2b00b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f974e877c025cf6a6127731510dfad877fe9cd15093ccc5f76cbc1d626b2b00b
SHA3-384 hash: 905e1472a12fd26b86dc8c5d66b080a025162d92560d4856168b3453b050091188a2e56267d4964b870d565acc8110ba
SHA1 hash: 3ac5c634f52ac1e9a3af11b8562a821b09b48be2
MD5 hash: 322fdc926fb53c33f40c0c176f23c569
humanhash: gee-sierra-uranus-maryland
File name:Nuevo orden.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:409'550 bytes
First seen:2020-07-29 10:56:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:zLlh35+UyC5sLxnkyJN6OxuH7t2dRvkG20hO73aA23gwxxgihO8dryJRt88F:FtUUyewQOxuH7tMsG1wHajxnheJRn
TLSH 2D9423E984F1BA54A0876D7A23F7B8774316E64BAF25B0DD12471231CF2671181A8BCE
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: srv.msyyazilim.com
Sending IP: 31.207.81.62
From: Mersud Talcahuano <mersudthno@mersud.cl>
Subject: Nuevo orden
Attachment: Nuevo orden.zip (contains "Nuevo orden.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f974e877c025cf6a6127731510dfad877fe9cd15093ccc5f76cbc1d626b2b00b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 06:02:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7f2oq56aexhwuyjhomkrbx5nq576ttivbe6myx3wzpa5mjvswafq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f974e877c025cf6a6127731510dfad877fe9cd15093ccc5f76cbc1d626b2b00b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip f974e877c025cf6a6127731510dfad877fe9cd15093ccc5f76cbc1d626b2b00b

(this sample)

FormBook

Executable exe f199ddc51e67123423b6d58ce8cb90b7ac939fec447fedf647650f09497d1c46

  
Dropping
MD5 ed9a0f1d1352ed6a6443bca4483e6e83
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f199ddc51e67123423b6d58ce8cb90b7ac939fec447fedf647650f09497d1c46

Comments