MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83cd204612085ef4b52c9c636002643cfbbc567d617a934a9f424414fba64fff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 83cd204612085ef4b52c9c636002643cfbbc567d617a934a9f424414fba64fff
SHA3-384 hash: 8b56d0194e69d3c8a3eeabd466845db07bb292669d6ee618f543d00fb66d8c843369aceb3cc7288d573c5bedf918b3b4
SHA1 hash: 412b2e483801618936ed1e5eb589d70cd6797e32
MD5 hash: 729819f6ce457a767f61794f62d3cc09
humanhash: neptune-helium-pennsylvania-hydrogen
File name:proforma Invoice Sheet.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:558'266 bytes
First seen:2020-12-14 14:17:59 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:vh/sYRcUM9yRCBX+8tsGlEWuc+BN8mDtp9:FsBh9yRCBX+82GlJuHBh79
TLSH FAC423F4E42647B36D43F364C32C9E3444253EA6600A7D752498EF64516DEE8BF9360B
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "N.L.GUWLANI<vkjain@tspl-india.com>" (likely spoofed)
Received: "from tspl-india.com (unknown [103.99.1.144]) "
Date: "14 Dec 2020 04:47:05 -0800"
Subject: "RE: proforma Invoice Sheet"
Attachment: "proforma Invoice Sheet.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/83cd204612085ef4b52c9c636002643cfbbc567d617a934a9f424414fba64fff/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-14 09:46:57 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qpgsarqsbbppjnjmtrrwaateht53yvt5mf5jgsu7ijcbj65gj77q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/83cd204612085ef4b52c9c636002643cfbbc567d617a934a9f424414fba64fff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 83cd204612085ef4b52c9c636002643cfbbc567d617a934a9f424414fba64fff

(this sample)

Formbook

Executable exe b3097786feedaaac00e8cc6a96aea810733912c0f2205bb3abe6d2600c80eb54

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b3097786feedaaac00e8cc6a96aea810733912c0f2205bb3abe6d2600c80eb54
  
Dropping
Formbook

Comments