MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2
SHA3-384 hash: 51cee683ae7c9c83f3f4e453cbb13ae6bc8245e17b895132b058428aae454550a8982adcaeb6ee248ee7ece8aec8cb6f
SHA1 hash: 3dca422d026e869376b0af2463a66fa4ff542cda
MD5 hash: 3cd047618c993d6060a0bde354379533
humanhash: butter-two-colorado-uranus
File name:DOCX RFQ#4.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:469'312 bytes
First seen:2020-12-08 06:32:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:SNj5ehXWBUNuGukbAfSouHSlizlCqHXdpebGIya:SLEmBUNNV5tgINMF
TLSH D6A4234A50BA1693285824607CDFD5429BFED019DAEB01FA1BC645B9DAC2306FF50F3B
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Basra Office NBC <Basrah@naseem-baghdad.com>" (likely spoofed)
Received: "from naseem-baghdad.com (unknown [156.96.62.84]) "
Date: "07 Dec 2020 17:01:18 -0800"
Subject: "RFQ: MPI (Missan oil training institute) - New Orders Direct purchase 07.12.2020"
Attachment: "DOCX RFQ#4.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-08 06:33:06 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=khisynk7jhxhy2ojmtfsvy5qskcfzgo764iumfcnqvjjvplc6xba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 51d12c355f49ee7c69c964cb2ae3b092845c99dff71146144d85529abd62f5c2

(this sample)

Formbook

Executable exe 6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6387c2471bf35b00168f223167b632f3fa43a1fdd28e2de60eea41fd8275271e

Comments