MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f253249a8b46ac05c3febadbfffe831901bc254ae8367e19bc4e20c98dfb77c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f253249a8b46ac05c3febadbfffe831901bc254ae8367e19bc4e20c98dfb77c
SHA3-384 hash: c49f71a591ec3d78d10b4115138be68751ef737f84f30092cdaaa6455189a484210a059e4f9fefe0c84e28ddaf1aa881
SHA1 hash: 67655ca9e6214834131b539c3201556eb6427942
MD5 hash: 654a5f1cd2e268fc572f7fe2b739b9dc
humanhash: nebraska-romeo-queen-eleven
File name:new orders.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:744'563 bytes
First seen:2020-10-27 12:27:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:AaJESagKDlPe/RueJrTXxO2EtTIZwHrx6Ia0b1JPPxIPzmoJohB5tD5HMoj:hJkD1e/R7G2b2zP+PzroDDhMo
TLSH B2F43374AE9134A2EE83F2F92224E46C913D026DB8944453E7D6C1D4623864DBF4FE9B
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

From: Muniandy@domain.invalid, Loganathan <Loganatharn.Muniandy@Honeywell.com>
Reply-To: Honeywell Safety Products <purchasing@representative.com>
Subject: Requesting quotation
Attachment: new orders.zip (contains "new orders.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f253249a8b46ac05c3febadbfffe831901bc254ae8367e19bc4e20c98dfb77c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 01:45:24 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4stesniwrvmaxb75ow3777iggibxqsuv2bwpym3ytrazgg7w56a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f253249a8b46ac05c3febadbfffe831901bc254ae8367e19bc4e20c98dfb77c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 7f253249a8b46ac05c3febadbfffe831901bc254ae8367e19bc4e20c98dfb77c

(this sample)

Formbook

Executable exe 176b6a4f321a046262569c7e6302f9cd734282399645f8b13538489f5183a617

  
Dropping
MD5 5cd80ae158f9dd2f8dd30e2fbc2aa37e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 176b6a4f321a046262569c7e6302f9cd734282399645f8b13538489f5183a617

Comments