MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8198859f6abcd854b1ab48c4081c4a4246e439c21d5e5b6d8975f382c9056002. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8198859f6abcd854b1ab48c4081c4a4246e439c21d5e5b6d8975f382c9056002
SHA3-384 hash: 708f4a36e1f14bb0833272fd042ed18c2f44c09fd0186c6c3197b7c47c31a2a3db719b9c13ecbcb05e492c05c11a6989
SHA1 hash: 2a85892ea96418d19233255145273635ca08794a
MD5 hash: 93b823b2d6a401101b8dffcaed401d4b
humanhash: happy-mike-connecticut-cat
File name:Quote 121079_Price Availability.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:437'659 bytes
First seen:2020-08-12 16:16:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:syU8hu+/DwnTSWMCaD0K7kL5vEthdkAmb2iIxW:sI2SDwXL5sXoTI8
TLSH F094235FB5806EF9254C5AC4C8C78691CFA0875309BC79B23012579CFA71762BB16F8D
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: proma.com
Sending IP: 45.127.62.138
From: Peter Shawyer <Peter.Shawyer@Texceltechnology.com>
Reply-To: Peter Shawyer <office.p@dr.com>
Subject: Quotation Please & Availability // UR CONTACT US
Attachment: Quote 121079_Price Availability.zip (contains "Quote #121079_Price & Availability.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.RSharedStrings.2814.20324.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8198859f6abcd854b1ab48c4081c4a4246e439c21d5e5b6d8975f382c9056002/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-12 16:17:04 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgmilh3kxtmfjmnljdcaqhckijdoioocdvpfw3mjoxzyfsifmaba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8198859f6abcd854b1ab48c4081c4a4246e439c21d5e5b6d8975f382c9056002

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 8198859f6abcd854b1ab48c4081c4a4246e439c21d5e5b6d8975f382c9056002

(this sample)

Formbook

Executable exe d4224f6f5b734de53a5a7e5f5675b05f9a808deb058e64d00859146f8255594c

  
Dropping
MD5 5d061432063b989574425c27e749a0b1
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d4224f6f5b734de53a5a7e5f5675b05f9a808deb058e64d00859146f8255594c

Comments