MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 745e00e4a43761d5c4be5e29a539cda4e8ca2a45755b44e35321ced4a8d400c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 745e00e4a43761d5c4be5e29a539cda4e8ca2a45755b44e35321ced4a8d400c3
SHA3-384 hash: abf78946758dde2c0229065fa4a7e13630e22dd76751b75f12c6faa36db4eb5fc628383f8a72dd01e6c64ec3352b2b55
SHA1 hash: e7756aba22a0ea795c51dee0a38cd9df2b58a220
MD5 hash: 669bf2619644a7990942f3c2dac81c8d
humanhash: utah-wisconsin-shade-sweet
File name:Quotation.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:366'393 bytes
First seen:2020-08-05 06:32:42 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:B6o2kRacRRnZ3dewpQeZG84wg62EUhLko56T5fzinlDnLVAca72Ei1u4k7PBOeRD:B6mRlRRZNewpQcGvsUx+R+nVnBA4EwXk
TLSH 1974236E7D8E5B3EB76A8B0A2E9B2350B98267701074552A0374FF0F255B7336C4A34D
Reporter abuse_ch
Tags:FormBook Hostwinds zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: hwsrv-759308.hostwindsdns.com
Sending IP: 104.168.213.29
From: BETZEN JOSE | LOGISTICS COORDINATOR <info@crio2.com>
Reply-To: BETZEN JOSE | LOGISTICS COORDINATOR <info@crio.com>
Subject: Quotation Request
Attachment: Quotation.zip (contains "YEw0N670fLb3Qwz.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/745e00e4a43761d5c4be5e29a539cda4e8ca2a45755b44e35321ced4a8d400c3/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:34:06 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=orpabzfeg5q5lrf6lyu2koonutumuksfovnujy2tehhnjkguadbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/745e00e4a43761d5c4be5e29a539cda4e8ca2a45755b44e35321ced4a8d400c3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip 745e00e4a43761d5c4be5e29a539cda4e8ca2a45755b44e35321ced4a8d400c3

(this sample)

FormBook

Executable exe 0b6acf8d9861c0c69b88b7a7bf1427c5245bbd968e96db1cdb08b8432442c729

  
Dropping
MD5 767febc4e7ba132342b5271a06a370c8
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b6acf8d9861c0c69b88b7a7bf1427c5245bbd968e96db1cdb08b8432442c729

Comments