MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1aaee38dc40d9c590803161cf4780125bf1e807b2f9a1dfc7d5001bb6faaa50b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1aaee38dc40d9c590803161cf4780125bf1e807b2f9a1dfc7d5001bb6faaa50b
SHA3-384 hash: 3ba13bed9ea4f66bb486bf03b0e3d2f0a77bf8e4c0ac46ca495cfc5ecfb5cf1c12e91e3462a3bcf833f389d1e4bcc65a
SHA1 hash: f101ecc579373a75dac837ed647f757808c2b42c
MD5 hash: 9ba9cb7eb0fe3cce13d8537f307a87d7
humanhash: summer-oven-autumn-yankee
File name:Doc-Quotation.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:389'510 bytes
First seen:2020-10-26 14:53:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:DoH/23C7v/U42w2c/r6LHQqjZ/THa+Ph1vM6vB/gW+ohq5cMCJ/b8bfp9Qvnv:Dlyv+G/6Z/THaU0s/H+pSMCBmmvnv
TLSH E58423E2891AA7C357DA180CC6254BDFD745EA7F4C23E2F536630EE9B1E1990C6CA710
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: forhrprofessionals.info
Sending IP: 117.50.15.121
From: Antoinette Nikoletta <sales@forhrprofessionals.info>
Subject: RE: Germany || Quote our Different Designs
Attachment: Doc-Quotation.rar (contains "Doc-Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1aaee38dc40d9c590803161cf4780125bf1e807b2f9a1dfc7d5001bb6faaa50b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 14:55:10 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dkxohdoebwofscadcyopi6abew7r5ad3f6nb37d5kaa3w35kuufq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 1aaee38dc40d9c590803161cf4780125bf1e807b2f9a1dfc7d5001bb6faaa50b

(this sample)

Formbook

Executable exe c9b3c7ce6446a64df017cf3301ab24a7993b1336befdec8bab77332fe783e4d4

  
Dropping
MD5 f828a1f09517898f9de68b4756e0ca9b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9b3c7ce6446a64df017cf3301ab24a7993b1336befdec8bab77332fe783e4d4

Comments