MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 462608d3117437bed1331b743c1d0446076a0fb24c81772479a081a0829b3843. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 462608d3117437bed1331b743c1d0446076a0fb24c81772479a081a0829b3843
SHA3-384 hash: 3bbacbbffadade9a1a69931924392d920bb2eb7d5f00000c6c5b83cf6008f1cb78b4e056d487de11aead3af67b84f893
SHA1 hash: 486e7f3aa62d609c8b6ebf2d06ad6787855c46af
MD5 hash: 5777305668c954a19fd5093304ce575a
humanhash: grey-video-foxtrot-nevada
File name:file
Download: download sample
Signature Formbook
Create hunting rule
File size:621'265 bytes
First seen:2020-12-04 22:51:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CEeYfUg+9DNCBUaZtkouH13iTvO6YcIbEkTffvY93xnYLiS0RT:lLM1cWU5uV3iTvZIbEcnK5YLH0h
TLSH 57D4337E649497E1417890009421BF18FA2BA8F7338D7CF49D885AD9B492BEE57B4F03
Reporter fabjer
Tags:rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/462608d3117437bed1331b743c1d0446076a0fb24c81772479a081a0829b3843/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-04 22:52:06 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iytaruyroq335ujtdn2dyhieiydwud5sjsaxojdzuca2bau3hbbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/462608d3117437bed1331b743c1d0446076a0fb24c81772479a081a0829b3843

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 462608d3117437bed1331b743c1d0446076a0fb24c81772479a081a0829b3843

(this sample)

Formbook

Executable exe 1e978aeca824414a2dc136c53170762a358a51490786861f1f44784b5ff300db

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1e978aeca824414a2dc136c53170762a358a51490786861f1f44784b5ff300db

Comments