MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29cca37d6dc2627a5ebf4301f5c34039493f014be180aee6abb8181d0509a912. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29cca37d6dc2627a5ebf4301f5c34039493f014be180aee6abb8181d0509a912
SHA3-384 hash: 537068892c8b76eab64583413c4a4a65a01ef6efe219812749e344e358e63219685cdb4051e76c81eed4a2beb549bf66
SHA1 hash: a90c379d274650561f14361e5de65be83eade3f8
MD5 hash: 4d9cd93c82192d7d9a6bb4d14c17457e
humanhash: mirror-vermont-beryllium-october
File name:M.V. CHIANG TUN.pdf.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:702'722 bytes
First seen:2021-01-12 07:22:40 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:TW7hVsk1h2fQlY5MbMDCLm2xHEALtN49Ttqkd+v0u8zoHts/KhtQOcW4PV:QVsk1AfQliEMJ2xHExtqqK0/ots/KhZA
TLSH 15E423E7D068275BEB919080E7B3EACD09C29C1D343E5AC91792D79F0D86DC091EAD83
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: smtp16.dnsxperta.com
Sending IP: 217.13.93.142
From: Sunariah Abidin <liner@asc-asia.com>
Subject: M.V. CHIANG TUN V. 2102
Attachment: M.V. CHIANG TUN.pdf.arj (contains "M.V. CHIANG TUN_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29cca37d6dc2627a5ebf4301f5c34039493f014be180aee6abb8181d0509a912/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 07:23:23 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fhgkg7lnyjrhuxv7ima7lq2ahfet6akl4gak5zvlxamb2bijveja._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/29cca37d6dc2627a5ebf4301f5c34039493f014be180aee6abb8181d0509a912

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 29cca37d6dc2627a5ebf4301f5c34039493f014be180aee6abb8181d0509a912

(this sample)

Formbook

Executable exe f8a388fc032aa7fdf80ed5bad850e3429ee27614bd6152efaa090fc77ad3bc6a

  
Dropping
MD5 e16fc6dd80b2adb86bfdcd9f4fe6a787
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8a388fc032aa7fdf80ed5bad850e3429ee27614bd6152efaa090fc77ad3bc6a

Comments