MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af174b636a9533b73ab2aa86c10959d2cdd6c775ee800d4698f1e47262fce7a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af174b636a9533b73ab2aa86c10959d2cdd6c775ee800d4698f1e47262fce7a7
SHA3-384 hash: 973907f23701592c794fd854242e8096742d5a639d3a18d17df213a9e83bd5b8218b6fb55008d22a3b662d0c9b66ed40
SHA1 hash: 6f706b3289523ee8dcd38c7d968e72d22c37fcce
MD5 hash: 6c4ad8094e9a6028f026c19ca39dfe25
humanhash: venus-uniform-mirror-carolina
File name:TT copy.r15
Download: download sample
Signature Formbook
Create hunting rule
File size:585'141 bytes
First seen:2020-10-23 06:55:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:FzRBaqykFxal1sFDmCDIAPh7mHOFbhHv40CfxHyoD7finkz+xf5QR4lETO3dDpm6:Fz5yCxc1ADmCsAp7IQ5vgpSS7Nz+xf5t
TLSH 27C423FE231AB0D2A662176E8FF6406DB4858792234E2FCA19E73BDC351DD4142C96D3
Reporter abuse_ch
Tags:FormBook r15


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: sharp.co.kr
Sending IP: 103.125.191.170
From: jy_lee@sharp.co.kr
Subject: 50% advance payment
Attachment: TT copy.r15 (contains "TT copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af174b636a9533b73ab2aa86c10959d2cdd6c775ee800d4698f1e47262fce7a7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 05:05:50 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v4luwy3ksuz3oovsvkdmcckz2lg5nr3v52aa2ruy6hsheyx446tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar af174b636a9533b73ab2aa86c10959d2cdd6c775ee800d4698f1e47262fce7a7

(this sample)

Formbook

Executable exe 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4

  
Dropping
MD5 957f36fdc73e2f696761e49bf541fc45
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c288fd70a35727c16e668d49e1e28964d36a67804e09be663bca9a9ceaeacb4

Comments