MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d3ee1e67e3e948bd111d6df4671d71e9df024ef8e37b3fa9cfee095de8e2847. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d3ee1e67e3e948bd111d6df4671d71e9df024ef8e37b3fa9cfee095de8e2847
SHA3-384 hash: b594dea83a6a1a0d579cc4897df9a269027d348c5a658d1fc8986068f498743622ddfa59a8e86588f58c8673c2c5ddcb
SHA1 hash: d7df580423fa53d5889e7cdb64c78fad36603cda
MD5 hash: 49bf3a70ee91ce423fbf03b4b22abb85
humanhash: eight-earth-green-cola
File name:HS361 dt 22.10.20.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:386'398 bytes
First seen:2020-10-22 07:41:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:qzPbkcDvQbtI9YMGBo2hNHgvCljtZSS8CJ1TRLLLne/sgMAPcCwM1cDpdh5+P:WbkWQbk2XtLLe/sBAPc4CDp5+P
TLSH F28423D49868AAAF5FE8392B9529A53537396193EB03E850D64BC343FB3CD1D6C6F400
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: G Joseph <support@qbasica.com>
Subject: FW: Freight Invoice - TRUE LOGISTICS [P] LTD
Attachment: HS361 dt 22.10.20.zip (contains "HS361 dt 22.10.20.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d3ee1e67e3e948bd111d6df4671d71e9df024ef8e37b3fa9cfee095de8e2847/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:54:14 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lu7odzt6h2kixuir23pum4oxd2o7ajhpry33h6u473qjlxuofbdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5d3ee1e67e3e948bd111d6df4671d71e9df024ef8e37b3fa9cfee095de8e2847

(this sample)

Formbook

Executable exe d796f6805d3b2379a57954f070415cabded6cf360544f1ba36acb75d558449db

  
Dropping
MD5 7df9a7f352c018c778c850727074fb09
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d796f6805d3b2379a57954f070415cabded6cf360544f1ba36acb75d558449db

Comments