MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47d2b633a1ff5b56e3597ee4bba6ade5cea16f3841752626155a9659d1e092ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47d2b633a1ff5b56e3597ee4bba6ade5cea16f3841752626155a9659d1e092ae
SHA3-384 hash: 8abdc55d6fa53cfa37a0412bf382be77bbd476959c550cfe058d0177ec779ceba79e4255ab01fde8557d3f48f750c25e
SHA1 hash: a25c9c5e1b474228bcbe96587802857c224770b7
MD5 hash: 7c31d24551f60910e6f78e1edbed9b4e
humanhash: fifteen-lake-aspen-mississippi
File name:Transfer update.CAB
Download: download sample
Signature Formbook
Create hunting rule
File size:205'209 bytes
First seen:2020-07-03 06:12:10 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:ti2VwxEWierY7s69ExOWbqwspepiDahdxZmTG38CINW0l:cmaiQt69Exdb3IaLneNp
TLSH 2E14227448CDDA232D769945FA4FE7B7F0A2989AFF36A61804E408C1A15DCFC7D14981
Reporter abuse_ch
Tags:cab FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mgabilisim.com
Sending IP: 185.78.85.242
From: Jacklan <jacklan@sbsbio.com>
Subject: RE: Invoice
Attachment: Transfer update.CAB (contains "Transfer update.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47d2b633a1ff5b56e3597ee4bba6ade5cea16f3841752626155a9659d1e092ae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-03 06:14:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7jlmm5b75nvny2zp3slxjvn4xhkc3zyif2smjqvlklftupaskxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 47d2b633a1ff5b56e3597ee4bba6ade5cea16f3841752626155a9659d1e092ae

(this sample)

Formbook

Executable exe b20e67792a0edf233f319f7af96f189451bb8cd4df24c93fcf0e586a473f552d

  
Dropping
MD5 ede142a331e2127b161f8e531a586ded
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b20e67792a0edf233f319f7af96f189451bb8cd4df24c93fcf0e586a473f552d

Comments