MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40347f8a49eca3e68b523301b1ab61cc70a93b2d5284ffb484a0d34345e7b2ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40347f8a49eca3e68b523301b1ab61cc70a93b2d5284ffb484a0d34345e7b2ef
SHA3-384 hash: fc9589fd22b5e8afec9e9be6539eda7e8e79fc7c4cb3567f1e727a48f272405e5aea823f368ebb44d010a0006515d6e3
SHA1 hash: d3ecd77f2093a5682040fe62db6e3889ff2d124a
MD5 hash: f4a726b32ebd9ae1746254b72d9f1065
humanhash: idaho-helium-gee-football
File name:Ordem de Compra.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:627'438 bytes
First seen:2020-10-21 07:19:12 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:3kJJU9iJIJtTl5K8LVS896xNlgWKxAA4aRnQqUGy9lwftbRVBXLw/HuGJ:UJ9GJtR5DLVSvxNlgWKxjzQZblwVvBXa
TLSH 72D423AE603C46FE042085AECBDC7B460557904AF26E50FA6FFD911CB193E9E2FB1854
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: host2.himbimarket.com
Sending IP: 72.52.244.66
From: Andrea Sanchez <export@filtroscartes.com>
Subject: RES: Ordem de Compra
Attachment: Ordem de Compra.zip (contains "Ordem de Compra.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40347f8a49eca3e68b523301b1ab61cc70a93b2d5284ffb484a0d34345e7b2ef/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 12:41:13 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ia2h7csj5sr6nc2sgma3dk3bzryksoznkkcp7neeudjugrphwlxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 40347f8a49eca3e68b523301b1ab61cc70a93b2d5284ffb484a0d34345e7b2ef

(this sample)

Formbook

Executable exe 03f5b9544b3bb2db290e54dfe203f425374d973ac225df52a7cb29adc7998726

  
Dropping
MD5 bc14d13f1d7d4299cb07aff24b039b07
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 03f5b9544b3bb2db290e54dfe203f425374d973ac225df52a7cb29adc7998726

Comments