MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27bd28adbedb804f1473f71e557094cba4928e6f7fd5430b6ac63dcf0e705657. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27bd28adbedb804f1473f71e557094cba4928e6f7fd5430b6ac63dcf0e705657
SHA3-384 hash: ce947fa7385df3470dbe1043c70b4226484cd4554b86a5e661aed25d64df32a73730e70f00195edc9537792463250589
SHA1 hash: e6efdcdc50b0f3592be94a6c30cfd113ca360415
MD5 hash: 29ad0fe17af3a3c11a1a280ab91f5c8c
humanhash: quebec-white-double-carolina
File name:Quotation and New price.img
Download: download sample
Signature Formbook
Create hunting rule
File size:1'769'472 bytes
First seen:2020-10-27 12:28:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:NeaeUZhXmDLtw55gBbR38Wn1iQunhC/QtciUisRC6qLrx0Z5GNS5Luf7DXHVQeh5:BXmHa5ulwFyQtdwJ/GNS5LhuweUA
TLSH 7885A5AD325072EFC457C972DEA81C68EBA0787B831B8253B05715EDAA0D997CF150F2
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: unolar.com.br
Sending IP: 193.142.59.117
From: atendimento@unolar.com.br
Reply-To: atendimento@unolar.com.br
Subject: Bor Quote/ New price
Attachment: Quotation and New price.img (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27bd28adbedb804f1473f71e557094cba4928e6f7fd5430b6ac63dcf0e705657/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 02:16:02 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e66srln63oae6fdt64pfk4euzosjfdtpp7kugc3kyy646dtqkzlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/27bd28adbedb804f1473f71e557094cba4928e6f7fd5430b6ac63dcf0e705657

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img 27bd28adbedb804f1473f71e557094cba4928e6f7fd5430b6ac63dcf0e705657

(this sample)

Formbook

Executable exe e65c009e0590869d174488fdd7ef00ac7cdac8aa047e7bafec28375fe020df18

  
Dropping
MD5 c10a83b27005e18e8b9a9852fb907c55
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e65c009e0590869d174488fdd7ef00ac7cdac8aa047e7bafec28375fe020df18

Comments