MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dc9242174f1a2ab0c304d3cc5ab7e5ba900f252c7f1bef2b408174517070869. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dc9242174f1a2ab0c304d3cc5ab7e5ba900f252c7f1bef2b408174517070869
SHA3-384 hash: ae3268d9e361e9dbc416f1c8a64415087ee5022f6826b5b7893cddfeb9eefeb22fd3810f4f340928051a446f9895d75c
SHA1 hash: 5c00881d94927c9fba937ef2d0d18775a9a9ec3f
MD5 hash: 54549d3228636cd5c86aa545dc686080
humanhash: louisiana-apart-kitten-november
File name:ORDER094633.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:487'297 bytes
First seen:2020-08-18 08:50:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:DrJfsDPwGh7sFRak0yRkbhRNBb6f40HYvvYs8+soXGZjKmjdI2FGiC2apQNI3on8:ZfGoNakBkbhLBb6PHY4l0JmRpMqvNzTI
TLSH DFA423D06BA392149847CB2311E270F172D3319F3B941960FAA8BECF55CEA49DA5770B
Reporter abuse_ch
Tags:Endurance FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-241-204-248.unifiedlayer.com
Sending IP: 162.241.204.248
From: jorge <info@rassau-seafood.de>
Reply-To: info@rassau-seafood.de
Subject: ORDER08162020
Attachment: ORDER094633.rar (contains "UVMXBIMGPQmBopg.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dc9242174f1a2ab0c304d3cc5ab7e5ba900f252c7f1bef2b408174517070869/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 23:23:58 UTC
AV detection:
16 of 27 (59.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxesiilu6grkwdbqju6mlk36louqb4ssy7y354vubalukfyhbbuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3dc9242174f1a2ab0c304d3cc5ab7e5ba900f252c7f1bef2b408174517070869

(this sample)

Formbook

Executable exe 85915cd56ea653449e15a3f3b393bf398c1135221139d75a5349b51831413937

  
Dropping
MD5 57922b4e9d102a43d8758ba35df42969
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85915cd56ea653449e15a3f3b393bf398c1135221139d75a5349b51831413937

Comments