MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc60f35036615326fe349934764aebaeb7d0bdc39dde5603a57cc7ee08f66171. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc60f35036615326fe349934764aebaeb7d0bdc39dde5603a57cc7ee08f66171
SHA3-384 hash: ff9b46b5f13c91b3130f1d1fe676440eba824eea03ec71998bb91224d3809188e0d4813c5653e06cb96511f38109b10b
SHA1 hash: 05b1c5f637502bff01812f9e0b1cae2ebdc82ce4
MD5 hash: 79f181591ca264363711dacff08f30e1
humanhash: butter-california-avocado-california
File name:ENQUIRY PLEASE.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:317'838 bytes
First seen:2020-05-06 09:49:11 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:j6gJLSmEw/rFxq6PLODuGD2dByBMSGZs2VY/BKTIPC5R42:+hmEw/fTaue2d0i53TI8
TLSH FD6423499084FBE4689B1E5FD9FA426E96CDC1D4E133078D442D633C1D6B93B319A63C
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: colorntouch.co
Sending IP: 111.90.141.162
From: Purchasing <purchasing@majuuniversal.com>
Reply-To: intertradeemito@gmail.com
Subject: REQUEST FOR QUOTATION - PR-S/P-100789
Attachment: ENQUIRY PLEASE.rar (contains "ENQUIRY PLEASE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 10:37:07 UTC
File Type:
Binary (Archive)
Extracted files:
51
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7rqpgubwmfjsn7rute2hmsxlv235bpodtxpfma5fptd64chwmfyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar fc60f35036615326fe349934764aebaeb7d0bdc39dde5603a57cc7ee08f66171

(this sample)

FormBook

Executable exe 150bca9ea5a4c5835f0e665b2db300d12a741b3a452c74678be7d0ee8236668f

  
Dropping
MD5 d61ae62c42d047b697c3b61e683112cf
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 150bca9ea5a4c5835f0e665b2db300d12a741b3a452c74678be7d0ee8236668f

Comments