MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad6d02dac950318df1efa004cb9368216b5b4f857fe510c29f64bcad6ae94ad5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad6d02dac950318df1efa004cb9368216b5b4f857fe510c29f64bcad6ae94ad5
SHA3-384 hash: 33e73301fb4f1005783ac0816505f4407d1b7131818a2bd590da8010f6c441689c8ce484b914b29728be10271ef4eee2
SHA1 hash: 7b9462a4ec68c1f23daddc82660a15e804f735fc
MD5 hash: d30bbd2c0dadd02b9ff571144e91ef76
humanhash: eleven-papa-potato-winner
File name:PURCHASE ORDER.GZ
Download: download sample
Signature Formbook
Create hunting rule
File size:350'576 bytes
First seen:2020-07-16 09:20:56 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:mlCUo311HJQrkCpituQywR63gI4uWxM3dF+tzjz5EULskWqsXw+wJlXtKp:mwPnidpiA3X4rxQvmz/5EeZWqEw+wJl6
TLSH 2D742305EE947D0F6322A44797A348451263E5E0F6687AC19D08CCDBC669326BBCFF63
Reporter cocaman
Tags:FormBook gz


Avatar
cocaman
Malicious email
From: "jr@barunka.pw" <hr@yangtwang.pw>
Received: from barunka.pw (ns1.barunka.pw [104.168.201.149])
Date: Thu, 16 Jul 2020 01:18:40 -0700
Subject: PURCHASE ORDER
Attachment: PURCHASE ORDER.GZ

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad6d02dac950318df1efa004cb9368216b5b4f857fe510c29f64bcad6ae94ad5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 09:22:05 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vvwqfwwjkayy34ppuacmxe3iefvvwt4fp7srbqu7ms6k22xjjlkq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz ad6d02dac950318df1efa004cb9368216b5b4f857fe510c29f64bcad6ae94ad5

(this sample)

Formbook

Executable exe 57234a3ec3bf2d3e6539a25221595d791fcf68dbed39a942651819c74fc3c664

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 57234a3ec3bf2d3e6539a25221595d791fcf68dbed39a942651819c74fc3c664

Comments