MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ce4781463935e1e51aec17db977dbb592a84dddd7d28177846d4d35633d35a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ce4781463935e1e51aec17db977dbb592a84dddd7d28177846d4d35633d35a2
SHA3-384 hash: 06fd39e71610497776430facc6c6a21740d5312bc5460b062993c30374a1b7a945ef71479f5cb0674397a8465241e1d7
SHA1 hash: e6c1f9d1a163a31f31f54b6e94d452d190ecf4e7
MD5 hash: fac204d7b8dde2af7733f2fafe66a3ff
humanhash: ceiling-twenty-happy-hamper
File name:po.cab
Download: download sample
Signature Formbook
Create hunting rule
File size:893'753 bytes
First seen:2020-12-17 08:51:02 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:sCx2oos80jmb50PqtGBL/ni6xsYALBZslWHX6e/vIi:7TRjANKL/n9xsYALBZslMZvIi
TLSH 531523D9F39DE5A5D21FE03195270E6844021336237D268E229CE63D548D3F8BE7A4AF
Reporter abuse_ch
Tags:cab FormBook geo KOR


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail-smail-vm44.hanmail.net
Sending IP: 203.133.180.232
From: 존 박 <alim119@daum.net>
Subject: 우리를_인용하십시오
Attachment: po.cab (contains "po.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.480.3643.26246.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ce4781463935e1e51aec17db977dbb592a84dddd7d28177846d4d35633d35a2/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:51:05 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dtshqfddsnpb4unoyf63s563wwjkqto527jic54envgtkyz5gwra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ce4781463935e1e51aec17db977dbb592a84dddd7d28177846d4d35633d35a2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

cab 1ce4781463935e1e51aec17db977dbb592a84dddd7d28177846d4d35633d35a2

(this sample)

Formbook

Executable exe fa1e4180024c1bb17610a4c0d6d3fd40b863c34016b131f1ce08fbcc140ce257

  
Dropping
MD5 a0c70a509c6122b6a5c004d08ddb7fc7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fa1e4180024c1bb17610a4c0d6d3fd40b863c34016b131f1ce08fbcc140ce257

Comments