MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1796acbc33f359649dc07c84b9e403f9bb1238a0259962c23ef15768de6085d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1796acbc33f359649dc07c84b9e403f9bb1238a0259962c23ef15768de6085d4
SHA3-384 hash: 73c1d473af3f5746b681a4c80609695812081223473cadfb7e61db326fa92992c067723a3454dba941f434081acfe325
SHA1 hash: 1e0e02fe4a0ff5c830e8ffcc05ab8d1c2e42cdf2
MD5 hash: 05181e08b444b49c4f6d01667b598b2d
humanhash: juliet-alanine-crazy-carbon
File name:purchase order.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:515'082 bytes
First seen:2020-10-19 07:22:41 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:ZLFErCguksy/7Nm/vkN7LmsrCG8i6YSlkFRvto:Zh6ukJm/w7kjQSlQFo
TLSH 0CB423892EF56C512659FE35FC791000653D3068C5C9780BAE9CB28207EE673ABF645F
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hkm4c.com
Sending IP: 103.125.191.170
From: HongKong Mini4WDChannel <info@hkm4c.com>
Subject: RE: PURCHASE ORDER
Attachment: purchase order.rar (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1796acbc33f359649dc07c84b9e403f9bb1238a0259962c23ef15768de6085d4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 03:55:22 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=c6lkzpbt6nmwjhoapscltzad7g5reofaewmwfqr66flwrxtaqxka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1796acbc33f359649dc07c84b9e403f9bb1238a0259962c23ef15768de6085d4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 1796acbc33f359649dc07c84b9e403f9bb1238a0259962c23ef15768de6085d4

(this sample)

Formbook

Executable exe b8e4dfdddae3c40ef710797605631573fe5689ae296637a411a88f8f3c1d7389

  
Dropping
MD5 4b3bf3191eae4db584b8fb1b5b96ffe9
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b8e4dfdddae3c40ef710797605631573fe5689ae296637a411a88f8f3c1d7389

Comments