MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19f0cebab143a13b870fe65d114f3773c5474e4f88e3cfaa5bd3606cf4185960. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19f0cebab143a13b870fe65d114f3773c5474e4f88e3cfaa5bd3606cf4185960
SHA3-384 hash: e1884dc1720548328054946ff592ca74b4c9b0996e4460765c71fb59522a0c55ea23549878bd1beb47944c3a1c4d3177
SHA1 hash: 26bdfc764b375e13a5746be5f7ba9ecd4fef94c6
MD5 hash: 9e56613e4ca39adace0baca5caf4bb1b
humanhash: william-cold-mississippi-fruit
File name:Purchase Order_Requirement.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:581'623 bytes
First seen:2020-10-22 07:41:38 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:xUnkldRhapOYLjjWmfxhkAHyQwTN9iXe4ZdxDrZl+iwrf:QkldRwtjWm5QQC90JZ/DmL
TLSH E4C42335A18A0B224BC4F1BACF746617BC20552FB1D18B99793AC1C858DEDFE433C6A1
Reporter abuse_ch
Tags:FormBook gz


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: WIN-CLJ1B0GQ6JP
Sending IP: 193.142.59.181
From: Richard <info@abcvalve.com>
Subject: PO52885312
Attachment: Purchase Order_Requirement.gz (contains "Purchase Order_Requirement.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19f0cebab143a13b870fe65d114f3773c5474e4f88e3cfaa5bd3606cf4185960/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:54:42 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dhym5ovrioqtxbyp4zorctzxopcuotsprdr47ks32nqgz5aylfqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 19f0cebab143a13b870fe65d114f3773c5474e4f88e3cfaa5bd3606cf4185960

(this sample)

Formbook

Executable exe b35bd4c70b7e7b6ef3a3a0b1196720b542e78137476b52380b352af1633432b2

  
Dropping
MD5 0f334a82ce6a7b54b9adb225544f6839
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b35bd4c70b7e7b6ef3a3a0b1196720b542e78137476b52380b352af1633432b2

Comments