MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e5b5f2b76e4517a13a454f8c27bfc08854fc49ce836693902c20b8c1d173498. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e5b5f2b76e4517a13a454f8c27bfc08854fc49ce836693902c20b8c1d173498
SHA3-384 hash: 5784252d2012a7dd70271c6010a8d2ba780c9da953ac9224f9e059717c3742d9342cf1a508f0a5722dc563dda77204d6
SHA1 hash: 3fb91ffafcbe00ad494c39b4d417a3b3b73869f9
MD5 hash: b6db01a7df5959892721a01ff6639eec
humanhash: red-green-burger-triple
File name:New Purchase Order 501,689.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:631'447 bytes
First seen:2020-10-13 10:38:43 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:47+pi7TgeObE+c4cb6Ek7lOu3PKH5mUm7muGoKA2vpTfNK1MPtY6/qc/6o+:4Mi7TFm/c4S6E2OufKH5+rGoY4Ob/qcM
TLSH 31D433AB473729DCB5231F440D424FA679FE56C3260784B2F8C5BA4185BCD84D3E26BA
Reporter abuse_ch
Tags:FormBook GMX rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mout-xforward.gmx.com
Sending IP: 82.165.159.131
From: Gabriella Danisi <GabriellaDanisingam@planetmail.com>
Subject: Re: Purchase Order Details
Attachment: New Purchase Order 501,689.rar (contains "New Purchase Order 501,689$.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e5b5f2b76e4517a13a454f8c27bfc08854fc49ce836693902c20b8c1d173498/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 09:16:22 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fznv6k3w4rixue5ekt4me674bccu7re45a3gsoicyifyyhixgsma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2e5b5f2b76e4517a13a454f8c27bfc08854fc49ce836693902c20b8c1d173498

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 2e5b5f2b76e4517a13a454f8c27bfc08854fc49ce836693902c20b8c1d173498

(this sample)

Formbook

Executable exe c5a3dbe60ff325c179eaccd5731fac2bf328022dca3c42ad847108dadf54481b

  
Dropping
MD5 e512bda76827c64c60fea66c7a231b3e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5a3dbe60ff325c179eaccd5731fac2bf328022dca3c42ad847108dadf54481b

Comments