MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 129c3b93f37221ab2b1c05b1497ee12a98e65845cbeef158cb01a763bf14c98e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 129c3b93f37221ab2b1c05b1497ee12a98e65845cbeef158cb01a763bf14c98e
SHA3-384 hash: 34826437b072f7ac3b73bce97ecb877acb642bdd7bf3d8d70bbef5d6a9fa9c8160401ab886ea4eaa3d37a71525df8921
SHA1 hash: 442f190eb0e9217bbfadd88c13657df658753413
MD5 hash: f9bf055ef626193e92aac80e6e2b64ab
humanhash: crazy-magazine-violet-twelve
File name:quotation Texcel Tech PO_9376401.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:420'652 bytes
First seen:2020-08-18 07:40:07 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:B37UaPKHCYZrc80++BM9mf3dk8zUXzYaBrPUXJXQfXr3Nybq5730Mh:B37UC6rzwNxkUSEXej57l
TLSH D39423331B0E2ED3427F2C596AA00FFD9461ED6AC864A6A7ED4F6B0C34903F56D48519
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps26145.inmotionhosting.com
Sending IP: 104.247.72.208
From: Joanna Mason <Joanna.Mason@texceltechnology.com>
Reply-To: Joanna Mason <saleps@dr.com>
Subject: Quotation for Price & Availability // UR CONTACT US
Attachment: quotation Texcel Tech PO_9376401.zip (contains "quotation Texcel Tech PO9376401.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/129c3b93f37221ab2b1c05b1497ee12a98e65845cbeef158cb01a763bf14c98e/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 07:42:06 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ckodxe7toiq2wky4awyus7xbfkmomwcfzpxpcwglagtwhpyuzgha._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 129c3b93f37221ab2b1c05b1497ee12a98e65845cbeef158cb01a763bf14c98e

(this sample)

Formbook

Executable exe 9963cb9f95312d222c99fac596b5bf02d81ace63ebde79c37e2312d3e2ecd32f

  
Dropping
MD5 a18f288bdc00c828cea8b1d55ca23c4b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9963cb9f95312d222c99fac596b5bf02d81ace63ebde79c37e2312d3e2ecd32f

Comments