MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d7a843b3c272271e42474dc4eb75d86df96de63e4668aba4b2a4edc3c65c9af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d7a843b3c272271e42474dc4eb75d86df96de63e4668aba4b2a4edc3c65c9af
SHA3-384 hash: ba303b7aef6fdb6eb8121b7826bfade3b6d22fafa3660d1d712ad138b21810893895a1366389ae6de32c84ee5bb01d8f
SHA1 hash: ab845fddfab14d51a7a82d010280af07a8452908
MD5 hash: 63547115fd077b2e336f68fe6a505010
humanhash: nuts-florida-fish-social
File name:Factura de clients_0010002345.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:378'305 bytes
First seen:2020-10-05 12:13:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:MLXNJ/p31sIW1ybfj5FaZmfI013FBtxnimsQSkfzZ4R8iiWwGEnkRjCQHXQU:MhJ/R1sIW1YPa0Qe1BtJzSk76qQEoOQf
TLSH DA84238EF2B2DEE5AF96BC22B1F3EFB534784A0560427D7A5086D61FEDE1654024C344
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: terregroup.pw
Sending IP: 64.225.98.54
From: Administracion <contact@terregroup.pw>
Reply-To: duldi@duldi.com
Subject: Factura de Clients
Attachment: Factura de clients_0010002345.rar (contains "Factura de clients_0010002345.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d7a843b3c272271e42474dc4eb75d86df96de63e4668aba4b2a4edc3c65c9af/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 07:03:37 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fv5iioz4e4rhdzbeotoe5n25q3pznxtd4rtivoslfjhnypdfzgxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d7a843b3c272271e42474dc4eb75d86df96de63e4668aba4b2a4edc3c65c9af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 2d7a843b3c272271e42474dc4eb75d86df96de63e4668aba4b2a4edc3c65c9af

(this sample)

FormBook

Executable exe c8d85cc6740894dd1333bfa06c37b334a4f341cefbd13ef8fa803732aa688c40

  
Dropping
MD5 ea4d18020e7f3f44fabaf4c1dd24f5a9
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c8d85cc6740894dd1333bfa06c37b334a4f341cefbd13ef8fa803732aa688c40

Comments