MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9542069f6a717d31fedd79982c7008f1cad4f496c3645944e8c2e21f5abe7d81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9542069f6a717d31fedd79982c7008f1cad4f496c3645944e8c2e21f5abe7d81
SHA3-384 hash: 833e6a3bf9a4ba33bc9ae6339fe328cfca1575ff8b2d7d1f74b0f5a66c202d3226bc7d2ccad92d481177d038a1a804e6
SHA1 hash: 35b4be58517cb49a72ee7d178441026e84228e7b
MD5 hash: 52dd744fa2e7ef1fb724090eabfca5f7
humanhash: bluebird-island-single-south
File name:August First Purchase Order.pdf.arj
Download: download sample
Signature FormBook
Create hunting rule
File size:535'176 bytes
First seen:2020-08-04 07:01:27 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:adhu0DrPi5IEyZQxpmgYFQd1wdlGS/dgWXiRg:oTnK6Eym7oQd2dlGS/6WCg
TLSH F3B423D76B5CA1874682727418DCF3DF210FD5ADABE30E365C97CC65B2080BE151A1AB
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: server1.swisspac.es
Sending IP: 119.18.63.233
From: MARINA KNEZEVIC <marina.knezevic@exitltd.co.rs>
Subject: Urgent Purchase Order
Attachment: August First Purchase Order.pdf.arj (contains "August First Purchase Order.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9542069f6a717d31fedd79982c7008f1cad4f496c3645944e8c2e21f5abe7d81/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 07:03:19 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=svbanh3kof6td7w5pgmcy4ai6hfnj5ewynsfsrhiylrb6wv6pwaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9542069f6a717d31fedd79982c7008f1cad4f496c3645944e8c2e21f5abe7d81

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

arj 9542069f6a717d31fedd79982c7008f1cad4f496c3645944e8c2e21f5abe7d81

(this sample)

FormBook

Executable exe 0d59116557f0c4cf0f52239edbc0a9569489279bbe45a690597d9dd8a2401886

  
Dropping
MD5 0aefe97bc15bbf575e8e0b2be4d83dd3
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0d59116557f0c4cf0f52239edbc0a9569489279bbe45a690597d9dd8a2401886

Comments