MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19b8cd5d1d53c518b2f7d3370105a8e176f17f736c43bd58a183faf7f212f082. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19b8cd5d1d53c518b2f7d3370105a8e176f17f736c43bd58a183faf7f212f082
SHA3-384 hash: 3f5ecdad7b1e2bc45a86f6c670c6d0fa2c64f25b4305009d772dd43edf37d3bc82155fb059f0f286a4cf69e8a1f9a2a4
SHA1 hash: 1091f052c00a4402d84714bb122f59ecc53babd7
MD5 hash: 266d42cbc050adaf155625ee26336f16
humanhash: ohio-vermont-failed-rugby
File name:QUOTE_USD108,500-INV.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:669'783 bytes
First seen:2020-10-21 09:47:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:vylIJy2HjkuFLFuXgdrrxh342R5mEEKOmaPXY+v7lkV0K66MMSyHNQRwt:vYe5LiGrFt42RI49I7Y0KxSyHN8G
TLSH D7E42351A72254437BC4499A8C31E4971EEA89C466EEFFEACD14FF6E0DBCF872900016
Reporter abuse_ch
Tags:FormBook Outlook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: NAM11-BN8-obe.outbound.protection.outlook.com
Sending IP: 40.92.20.97
From: xinhle@hotmail.com
Reply-To: chukwudifrank56@yahoo.com
Subject: RE: RE: URGENTLY CONFIRM QUOTE FOR PAYMENT
Attachment: QUOTE_USD108,500-INV.rar (contains "e8NS1CJtIRhReBU.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19b8cd5d1d53c518b2f7d3370105a8e176f17f736c43bd58a183faf7f212f082/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 03:32:54 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dg4m2xi5kpcrrmxx2m3qcbni4f3pc73tnrb32wfbqp5pp4qs6cba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 19b8cd5d1d53c518b2f7d3370105a8e176f17f736c43bd58a183faf7f212f082

(this sample)

Formbook

Executable exe f755a2e09db3f63b7e9c035a488652b00ccb0678eca144db82e84e9e34345deb

  
Dropping
MD5 f34019df66e0cdc84771f64542276568
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f755a2e09db3f63b7e9c035a488652b00ccb0678eca144db82e84e9e34345deb

Comments