MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20246ec3ef911af3f9b418b758856092afa210437bcf4394fdc56f083d40a001. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20246ec3ef911af3f9b418b758856092afa210437bcf4394fdc56f083d40a001
SHA3-384 hash: e8400d17ecbdcbe69838d3aa2384cc190c3c45abf2fd9ad4ac8b8f7e6a828923058f4505ead04ac74a49481aad62d424
SHA1 hash: 71898368235e065dc2c872947fe468e1212f7aef
MD5 hash: 70842e9eb4f4905fa4e067a90240a931
humanhash: emma-sodium-eleven-march
File name:REQ-QUOTATION.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:271'840 bytes
First seen:2020-07-04 07:16:58 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:2RtbQVS/EGIas1XgKtEOXtWeA+IESwHVy9iDrtRBrhk:2HskWasIOXwxC//fB1k
TLSH 1B44226731FDC372A014E559EE087A792236D0E6FF2650AC22B5CEBADDFD0B84805619
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: dlveltex.co
Sending IP: 111.90.145.49
From: Cona Import Company <holy001@ms38.hinet.net>
Reply-To: holy001@ms38.hinet.net
Subject: RE:RFQ-QUOTATION
Attachment: REQ-QUOTATION.rar (contains "REQ-QUOTATION.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20246ec3ef911af3f9b418b758856092afa210437bcf4394fdc56f083d40a001/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-04 07:18:06 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=easg5q7psenph6nudc3vrblaskx2eecdpphuhfh5yvxqqpkauaaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 20246ec3ef911af3f9b418b758856092afa210437bcf4394fdc56f083d40a001

(this sample)

FormBook

Executable exe 6748690a2f2b4b6d137354eb13d5d86eb83867a372819c2377ac0f92975588e8

  
Dropping
MD5 9d73c8308f135873b200d7e2af7555f3
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6748690a2f2b4b6d137354eb13d5d86eb83867a372819c2377ac0f92975588e8

Comments