MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a40bbd0ff2805a581201c180e425a2ddb924d073dccdfb635b3533844a580e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a40bbd0ff2805a581201c180e425a2ddb924d073dccdfb635b3533844a580e2
SHA3-384 hash: 6462ae20af785eb68f73fb868821eeb49ee92cc895c4aa7884d1b4654a3f0daaabdbc8816f51d28227b295445323efa6
SHA1 hash: d9b14318b66829cdfbfeb702d7519358972f9688
MD5 hash: ea421027261bdc9ecd17a6eb777fe13c
humanhash: early-north-nine-jupiter
File name:QUOTATION_5.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:303'424 bytes
First seen:2020-05-26 10:00:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:cvXcul6ixY/MJTHylPTWKLAadwr0uQ4OAjXd8fg:MY/SibWKLf4094Bt0g
TLSH BC5423CC7AE75CA7F99242C6DA50322787B1D2F080746EA293619CF0F586A837547D2F
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: qualitech-solutions.cam
Sending IP: 111.90.140.145
From: Brian Richard <sales@qualitech-solutions.cam>
Subject: RE: CONFIRM QUOTATION
Attachment: QUOTATION_5.rar (contains "QUOTATION_#5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 10:36:46 UTC
File Type:
Binary (Archive)
Extracted files:
8
AV detection:
18 of 48 (37.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 6a40bbd0ff2805a581201c180e425a2ddb924d073dccdfb635b3533844a580e2

(this sample)

FormBook

Executable exe e2e86de59b03cd68c6795d391938d75dac7fa0fe0d5bf497a075402686eba01d

  
Dropping
MD5 03db6a5b5fcddd3568895d9212b1c69c
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e2e86de59b03cd68c6795d391938d75dac7fa0fe0d5bf497a075402686eba01d

Comments