MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3adc36256c39316d48532b94e503b2756fca27c7a82f218d163b27294f09a616. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3adc36256c39316d48532b94e503b2756fca27c7a82f218d163b27294f09a616
SHA3-384 hash: d4f0144bb9121799d3ec9ee3ba6baed59bc8e726736272e9635efd69eb9da93ce390aaa7cfc289f2287a9662ecfc2af0
SHA1 hash: 62f79dfd82aaffd4ca9c26b998022de2b6dfa29d
MD5 hash: 0eab6b461c93b623653c791fc1d0f689
humanhash: yankee-maryland-jupiter-stream
File name:Banking Details Review_Pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:357'059 bytes
First seen:2020-12-20 07:57:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:PDdtoCHD94D9JJMdpTN03KmiSJu2gSKs8CzwP2mMKkpPn586KNfnr:PJBj94DbK7G3FhyK8C+2nK8R8Xr
TLSH C274235C7C23AC67209ECED0AE7A1B1053945A0C6FB5246FEE2B5E1E1AD15173334E2E
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.coacb.com
Sending IP: 145.239.35.58
From: BNC BANK <paycheck@bnconline.com>
Subject: Payment Advice - (Authentification Error) Please Verify!
Attachment: Banking Details Review_Pdf.rar (contains "Banking Details Review_Pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3adc36256c39316d48532b94e503b2756fca27c7a82f218d163b27294f09a616/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-19 06:03:30 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlodmjlmheyw2sctfokoka5sovx4uj6hvaxsddiwhmtsstyjuyla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3adc36256c39316d48532b94e503b2756fca27c7a82f218d163b27294f09a616

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3adc36256c39316d48532b94e503b2756fca27c7a82f218d163b27294f09a616

(this sample)

Formbook

Executable exe 7e74cfc4a2605df540dbfb41d98d31a5ed80f24011687006c6818c72a0dab0d5

  
Dropping
MD5 f594f7b8cc6ddcdf4fa4ae86efc55a08
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7e74cfc4a2605df540dbfb41d98d31a5ed80f24011687006c6818c72a0dab0d5

Comments