MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5110e6eaa627517fca04a31f287f0b27e854aca253e2fc7cfabc3d468aeae062. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5110e6eaa627517fca04a31f287f0b27e854aca253e2fc7cfabc3d468aeae062
SHA3-384 hash: dfbd0cca265779e0d36264e91eabbd04a438225fe0b7953a556fb979d6d121cc0f422fb85fbb479af66ddee476d6dd30
SHA1 hash: 51d98fded9eb53c45dbe5e4e91c767ef725e3899
MD5 hash: c430aff20cea13c8d34d5b166c6e9a35
humanhash: twelve-arkansas-march-three
File name:PO 1,5001993 21118.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:424'289 bytes
First seen:2021-09-28 08:22:53 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:hxQFU7bLtOLvKbA3V9gPjfJlDr2W7if+BNuos1kiVCy:hqFU7b5OL8KV6H3m++f1gy
TLSH T12C94237B9C9BAFF0AB85CC1316A139591097DCF9A94628D08CA4BC7E8BD23D25D33D14
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Edd Smith (Woodlodge) <EddSmith@woodlodge.co.uk>" (likely spoofed)
Received: "from woodlodge.co.uk (unknown [185.222.58.155]) "
Date: "28 Sep 2021 09:16:25 +0200"
Subject: "Re: PO126126, PO126127, PO 126128"
Attachment: "PO 1,5001993 21118.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5110e6eaa627517fca04a31f287f0b27e854aca253e2fc7cfabc3d468aeae062/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 08:23:06 UTC
AV detection:
13 of 45 (28.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=keion2vge5ix7sqeumpsq7yle7ufjlfckprpy7h2xq6uncxk4bra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Formbook
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5110e6eaa627517fca04a31f287f0b27e854aca253e2fc7cfabc3d468aeae062

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 5110e6eaa627517fca04a31f287f0b27e854aca253e2fc7cfabc3d468aeae062

(this sample)

Formbook

Executable exe f5400b800544782acf9e16a80368cef1b36eed0e63fd0200523f3d38c54162e9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5400b800544782acf9e16a80368cef1b36eed0e63fd0200523f3d38c54162e9
  
Dropping
Formbook

Comments