MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 905520dbd3a50de49356d951bd21d29012457c21e586396dfe1357dec87664d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 905520dbd3a50de49356d951bd21d29012457c21e586396dfe1357dec87664d1
SHA3-384 hash: 1ef899ab6c8f9cce59464762fbb3118dfdcd11277a577964cd7a1a47e1f89605173d37424929b020d3664da74a19035b
SHA1 hash: cfa500f164885bba8bb287f6ba0c6e080726c242
MD5 hash: 268c1916ce805ccb2b88a702f0f07bc7
humanhash: october-moon-eleven-kansas
File name:PaymentCopy.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:480'895 bytes
First seen:2020-10-27 10:27:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:BIXvlgDFUuLQiXIrfA0OvXd25mLL0Pt4c:uflsn3nPUsLQ2c
TLSH 2EA4239DFD0EF53822189621DFCF38E1BD46D9C2971E6BB474F322C22650AA8D9151EC
Reporter abuse_ch
Tags:FormBook Outlook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: EUR05-AM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.91.10
From: ozcan_ucak@hotmail.com
Subject: Re Balance Payment
Attachment: PaymentCopy.rar (contains "Ny6iVw32tJawdsS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/905520dbd3a50de49356d951bd21d29012457c21e586396dfe1357dec87664d1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 03:42:19 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbksbw6tuug6je2w3fi32iossajek7bb4wdds3p6cnl55sdwmtiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 905520dbd3a50de49356d951bd21d29012457c21e586396dfe1357dec87664d1

(this sample)

Formbook

Executable exe 3e703d8a82c52ccbd83cfde999f09930dc8966608ac895916a248c795238c850

  
Dropping
MD5 cd496b71961871d78db1912f96d4cac0
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3e703d8a82c52ccbd83cfde999f09930dc8966608ac895916a248c795238c850

Comments