MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0be2b3666584ba80d0c8ae2606b95be719dc38fbb04a6059cc34529825996d53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0be2b3666584ba80d0c8ae2606b95be719dc38fbb04a6059cc34529825996d53
SHA3-384 hash: e6c91ef12dd8153d4b0b9574e8b94d0c9b44b9a0c97ef6870314dbbecd1dd6fc4559255e5b55398300f897aa22a31412
SHA1 hash: 5c949be4f712dd59864872b198bb5ae823c2ca8b
MD5 hash: cdcb31f9b23b96c5b90a0d34a73b2781
humanhash: uniform-moon-sierra-pizza
File name:Scan_order9215060196.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:257'477 bytes
First seen:2020-07-03 12:42:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gZPwRXiOXCWeGLIW9upCfzAtiwR+G3gV89B66L3KddSNbQ6/4wTypEa/gmiZ:kwR9XCSZupCrDwREqFL3Kd0xwaypEa/q
TLSH C54413B4CF25AB71381BCB6B6D4C20C21D7E6C4F361E27BD5D09169B84618FAC892E53
Reporter abuse_ch
Tags:FormBook rar Yahoo


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sonic307-2.consmr.mail.ne1.yahoo.com
Sending IP: 66.163.190.121
From: MUHASEBE Kadir BATUR <muhasebe@sasmazelektrik.com>
Reply-To: MUHASEBE Kadir BATUR <muhasebe@sasmazelektrik.com>
Subject: Re:Re:Re:Re: Confirmation Order
Attachment: Scan_order9215060196.rar (contains "Scan_order9215060196.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0be2b3666584ba80d0c8ae2606b95be719dc38fbb04a6059cc34529825996d53/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 12:44:07 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bprlgztfqs5ibugivytanok344m5yoh3wbfgawomgrjjqjmznvjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 0be2b3666584ba80d0c8ae2606b95be719dc38fbb04a6059cc34529825996d53

(this sample)

Formbook

Executable exe 896745863d78a02b1cf02565dbeb3bca4bfd156a1079d28c07ddfb2d8b9fc665

  
Dropping
MD5 3902d05dd23263e123e94136dbde2f38
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 896745863d78a02b1cf02565dbeb3bca4bfd156a1079d28c07ddfb2d8b9fc665

Comments