MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b0e45179830806aab681b154f24c73bd33b4c52dc00c17bb0df269d13c73560c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b0e45179830806aab681b154f24c73bd33b4c52dc00c17bb0df269d13c73560c
SHA3-384 hash: e988578fdfa47d807b8ebb147439b65071b6bce56830ceb1096dbc1860e193e69c733cd68da9c87d419b6a1cf4274c5d
SHA1 hash: 09b4a8e0e9cccf3dbf1305e144c44692c0fb34c8
MD5 hash: 4c4d8e5e702009f48e43345644a6596a
humanhash: hawaii-ohio-avocado-gee
File name:S12GF803.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:442'445 bytes
First seen:2020-10-18 14:43:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:5HjO8l4CxRvI1QHat+4+2c2RagI0q8OXfOofZOqdLXWtc:5Hjrl4CnvI1Rt+lg7qhWM7dLmtc
TLSH 1D9423A1477D33C6A44A39F68C78FDDF35BD2A0E735B22222934A34EBC646257458F02
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: cpanel8.wsiph2.com
Sending IP: 110.34.251.21
From: edward.sun@hengtai-law.ae
Subject: أمر المحكمة
Attachment: S12GF803.zip (contains "S12GF803.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Nanocore.23.29609.30830.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b0e45179830806aab681b154f24c73bd33b4c52dc00c17bb0df269d13c73560c/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 13:36:37 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wdsfc6mdbadkvnubwfkpetdtxuz3jrjnyagbpoyn6ju5cpdtkyga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/b0e45179830806aab681b154f24c73bd33b4c52dc00c17bb0df269d13c73560c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b0e45179830806aab681b154f24c73bd33b4c52dc00c17bb0df269d13c73560c

(this sample)

Formbook

Executable exe 50f48263f394b95976bbacb198facd4a274f820f92ecf624a228251359627a93

  
Dropping
MD5 cebaecba36aae63450c82b38b83d3680
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 50f48263f394b95976bbacb198facd4a274f820f92ecf624a228251359627a93

Comments