MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ac84f884beff26ba57cccb2edb7c9d89e555ec5b573be6b0ee31186d82f0aa8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ac84f884beff26ba57cccb2edb7c9d89e555ec5b573be6b0ee31186d82f0aa8
SHA3-384 hash: 524feb618a828d34042a79d1247e98897987cdea77a29abfa0f5041f00d460eb6b29e7ef27674d03413fee76936b6121
SHA1 hash: 5be0ac5f4dcf197b60c99849372fb12bf35e94b3
MD5 hash: 47b6aedf9b20def8a4b9d4795741c134
humanhash: blue-vermont-fifteen-dakota
File name:10-23.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:391'816 bytes
First seen:2020-10-23 06:49:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:EHrMocDvQptW9o0GBo23Nfg/CRjt7SS3hmnVMCiS7T9Z2FEDg/TLBoPA0MQeTdGG:WrMoWQp62Z/h8h7T9ZbDg/ZlSsgG
TLSH B28423C7A8A9B39F18C4F06AD4A7FCE449EC93CAD115DA95D88ED323F56C138345B019
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: newserver1.nexusmediaworks.com
Sending IP: 43.252.214.38
From: sharon@merryprice.com
Subject: Bank in slip
Attachment: 10-23.zip (contains "10-23.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.3840.20371.17221.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ac84f884beff26ba57cccb2edb7c9d89e555ec5b573be6b0ee31186d82f0aa8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 02:27:54 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=flee7ccl57zgxjl4zszo3n6j3cpfkxwfwvz342yo4miynwbpbkua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 2ac84f884beff26ba57cccb2edb7c9d89e555ec5b573be6b0ee31186d82f0aa8

(this sample)

Formbook

Executable exe f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05

  
Dropping
MD5 2ffe461efc70d9834d8552595d86a879
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f24849d70670b5448e96f02fe8bc12328bee2922be60f70ec8121531778f0d05

Comments