MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e
SHA3-384 hash: 8286c3864e3b3ee8abab761086bbef5bdd25d07c5704572c5fe6c296d8f3cbfe8a521bac5136bc824b83ee2c26668243
SHA1 hash: cac4b4a504a94832c477496a7957637cc25b131f
MD5 hash: 1d95f8a84bb4f8c7073dde22bf197d4b
humanhash: romeo-bacon-twenty-purple
File name:P33021.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:401'926 bytes
First seen:2021-03-30 12:16:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:MgsCEK5bFXOW1KagHGeOxQWfzGth3ZA+R/uWlO:MTNUp1YJ8fitT5/uWA
TLSH EA84237EE2144A0EF769FDC51204127A4E080B4CD655A301A3D1AAB3D9E2C4DBFFADB5
Reporter abuse_ch
Tags:lzh


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.iglogi-camo.com
Sending IP: 194.31.96.45
From: Sales <postmaster@iglogi-camo.com>
Subject: BANK IN SLIP
Attachment: P33021.lzh (contains "P33021.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-30 12:17:07 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jaw4ncfj5off6xrj6toyn2vfq6s53r672ujtg5vmf636fdojbaxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e

(this sample)

Formbook

Executable exe 2361f2a0e93f95a1019650c9b77f55014f9355b5b85ac8dbbd5bafb6b0cc967e

  
Dropping
MD5 fbbad3106a32c41fd44f16bcb1b150b4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2361f2a0e93f95a1019650c9b77f55014f9355b5b85ac8dbbd5bafb6b0cc967e

Comments