MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 503e32b4f29a5415e9f0a96055fc52ec3f79842fabdf71f1aec6976935853d85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 503e32b4f29a5415e9f0a96055fc52ec3f79842fabdf71f1aec6976935853d85
SHA3-384 hash: e3f50ff536b26aa224e9b3003a5ce68fc7f2af9d57dc3efa63f1e62d04100835cb4d1843d93249c513c00f2943e8fc42
SHA1 hash: 9a801d7307ed83dbd9e00059fa1adcb4556b2c82
MD5 hash: af8559e8cc757dddd1fecbfda0e04ecd
humanhash: september-sink-bluebird-north
File name:Chevron Thailand Limited - Quotation.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:544'848 bytes
First seen:2020-11-06 07:35:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:UdID/dH9YFBEpxEu7Kl+BP6h5FmLONPvStTgOlXq:UM/dmFBELiY8pNuFq
TLSH 7CC4230DE602F5B0B67417EB4E60F163AE0DFA199512E68D36723016F3CB7A8291EDD4
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Pairoj Kaweeyanun <cbutner@chevron.com>
Reply-To: k1@ecg-ingenieria.mx
Subject: Quotation Request
Attachment: Chevron Thailand Limited - Quotation.zip (contains "Chevron (Thailand) Limited - Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/503e32b4f29a5415e9f0a96055fc52ec3f79842fabdf71f1aec6976935853d85/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 07:37:11 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ka7dfnhstjkbl2pqvfqfl7cs5q7xtbbpvppxd4noy2lwsnmfhwcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 503e32b4f29a5415e9f0a96055fc52ec3f79842fabdf71f1aec6976935853d85

(this sample)

Formbook

Executable exe 1243c7dc1cfed0ab5eaad14206b0ef280338c865abb712bc6d677db77d850dcc

  
Dropping
MD5 38573fc523733971a06b6062d0238f1a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1243c7dc1cfed0ab5eaad14206b0ef280338c865abb712bc6d677db77d850dcc

Comments