MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8a3bea644fb9739a6f567ee1842048f186d83018cbaaf70ac2fb65173187e11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8a3bea644fb9739a6f567ee1842048f186d83018cbaaf70ac2fb65173187e11
SHA3-384 hash: f60ea91e255237f037d263afba8a6777ce02a5b402e77d9ce74f40520dfd54f6962004ed1235b4a86d73bc546171067b
SHA1 hash: 1074d9d4a4d759110189866cbb66c12d960b0734
MD5 hash: 40c35b54da97b41f74006a0332e13e42
humanhash: alanine-asparagus-california-hydrogen
File name:DOC_2020101209438759554.PDF.IMG
Download: download sample
Signature Formbook
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-12 14:46:04 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:7Mz2I70YH42lS4jLgY4GGR/YS1xLY5cROxAI3unuwLEI:7RS7M4nV4GGIcRkT
TLSH EB45F1323799AB26E87DD3BD0424104427F1F0A2E726D72A7D9D80DD0BA6F95C7A2743
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: mail.inconcertcc.com
Sending IP: 200.40.135.115
From: Jorge Juscamaita <jjuscamaita@inconcertcc.com>
Subject: AW: 21501120100258 - PURCHASE ORDER FOR INVOICE SUBMISSION
Attachment: DOC_2020101209438759554.PDF.IMG (contains "DOC_2020101209438759554.PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.445.10854.17619.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8a3bea644fb9739a6f567ee1842048f186d83018cbaaf70ac2fb65173187e11/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 06:55:56 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcr35jse7olttjxvm7xbqqqer4mg3aybrs5k64fmf63fc4yypyiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a8a3bea644fb9739a6f567ee1842048f186d83018cbaaf70ac2fb65173187e11

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

img a8a3bea644fb9739a6f567ee1842048f186d83018cbaaf70ac2fb65173187e11

(this sample)

Formbook

Executable exe b4213727c8bb27212ca209b37f9583f6b4b4b3a9ccb78c2a7d4f0057a469c65c

  
Dropping
MD5 300282451ca9742c52a667f932cebc11
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b4213727c8bb27212ca209b37f9583f6b4b4b3a9ccb78c2a7d4f0057a469c65c

Comments