MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8644eb030e96217a4ce867efd491af5820fbec964ece81dd0d0198ad849cc64f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8644eb030e96217a4ce867efd491af5820fbec964ece81dd0d0198ad849cc64f
SHA3-384 hash: e2eb61aefbbc17236fcd3522a80a5bce11e4c2b199629263a1dc3e05e6a0781c4e92c8001a52c02be1903a5a12821acc
SHA1 hash: c95888d76da58e3c183ca229ac6f8dd3718e8d7c
MD5 hash: 6e59146b326f28b570a381380058dcce
humanhash: utah-north-louisiana-oscar
File name:RFQ_V40795.pdf.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:574'115 bytes
First seen:2020-10-09 06:14:06 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:AwwqkDkNPIsx+pDVrJQNce0g379cXCPflAlx5SgwAnzcc7Xdd:ADqk2PIsMpDVrJQNce0keuflAPAgwqFT
TLSH 12C433D33615C769608AAD7A8CE332C6CD9CFD8D4B816FB1F499B29D54040AC20CB9DB
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: serve0.pcorpgroups.pw
Sending IP: 104.168.202.220
From: Yeongjae <rinno@rinno.co.kr>
Subject: Request for Quotation - V-40795
Attachment: RFQ_V40795.pdf.rar (contains "RFQ_V40795.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8644eb030e96217a4ce867efd491af5820fbec964ece81dd0d0198ad849cc64f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 00:47:45 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qzcowayosyqxuthim7x5jenplaqpx3ewj3hidxinagmk3be4yzhq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8644eb030e96217a4ce867efd491af5820fbec964ece81dd0d0198ad849cc64f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar 8644eb030e96217a4ce867efd491af5820fbec964ece81dd0d0198ad849cc64f

(this sample)

FormBook

Executable exe 9f335bab72c02acf039bc0366145e832630347a1d141dd1ae768637e52a1a7ce

  
Dropping
MD5 43bf3b91a4615aecaefb7addf915f9fa
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f335bab72c02acf039bc0366145e832630347a1d141dd1ae768637e52a1a7ce

Comments