MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a542a9750d158fec2fc1e1ada37daf097b806d96f2ccb897764934bb17a9d92c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a542a9750d158fec2fc1e1ada37daf097b806d96f2ccb897764934bb17a9d92c
SHA3-384 hash: b909a2a872dd47a2cb9331922f6622b14133e52d944b912c03db156036b5932684871bffbb2d60bfb36b9fb2b29ee1f1
SHA1 hash: 32d1fa949b80a206aa0ef4f9691309c0c1c4f315
MD5 hash: 6ab15becb4767772bbb4d308e6d8831b
humanhash: equal-ten-bakerloo-xray
File name:S12GF803.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:401'759 bytes
First seen:2020-10-05 14:22:01 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:l0hIQrLsH0RhfBF1KxFf7WpFaXXc0Dna1:l0m8La0LQYUcow
TLSH 0E84237651993368493F67F4CC5B07353C01A4A6A72F4DA206C3A7D50EAD1BEED83346
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: pizza-vip03.virtualhosting.hk
Sending IP: 203.135.158.166
From: edward.sun@hengtai-law.co.uk
Subject: Ordem judicial
Attachment: S12GF803.zip (contains "S12GF803.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a542a9750d158fec2fc1e1ada37daf097b806d96f2ccb897764934bb17a9d92c/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Suspicious
First seen:
2020-10-05 14:02:59 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvbks5incwh6yl6b4gw2g7npbf5ya3mw6lglrf3wje2lwf5j3ewa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.76
Link:
https://yomi.yoroi.company/submissions/a542a9750d158fec2fc1e1ada37daf097b806d96f2ccb897764934bb17a9d92c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip a542a9750d158fec2fc1e1ada37daf097b806d96f2ccb897764934bb17a9d92c

(this sample)

FormBook

Executable exe b4ccfbaa38c2372df5f18489426a89f3bedc15aefbd829179e88d672149bdd30

  
Dropping
MD5 0e64ba80b6d7f862f19987f36258fbea
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4ccfbaa38c2372df5f18489426a89f3bedc15aefbd829179e88d672149bdd30

Comments