MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4aa21cd87685c46574ac6c496b2f93c36cd3afa8ff84471447a7bce9bdd6af4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4aa21cd87685c46574ac6c496b2f93c36cd3afa8ff84471447a7bce9bdd6af4
SHA3-384 hash: a59418119d9a106833b3c3f289ee3c38800d2aa12088bc24b1ccc5db778e66e275e9647f19807152b36d5d9584331a40
SHA1 hash: 90e631a1566c7911675694c3135a8a4aebcf8dd1
MD5 hash: 7f2961ae114d8e8ad96a4f40198d6874
humanhash: april-zebra-lima-georgia
File name:new order 4567.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:252'395 bytes
First seen:2020-08-18 05:34:36 UTC
Last seen:2020-08-18 05:37:17 UTC
File type: z
MIME type:application/x-rar
ssdeep 6144:Ix6a1FFcoz3pETBMCOhE9/z92lCxNQIwrAA/Iy/fEDAn:IxPfzyNMYIwxNQXrAs
TLSH DA3423C509DD904DBA094E50FE494CE8984FCB217B9A16B3693B5ED3ACEC0524DECB87
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email
From: Emma Kimi<sales@kokocarpet.com>
Received: from kokocarpet.com (unknown [212.83.46.93])
Date: 17 Aug 2020 23:26:22 -0700
Subject: NEW ORDER INQUIRY
Attachment: new order 4567.Z

Intelligence

File Origin
# of uploads :
2
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4aa21cd87685c46574ac6c496b2f93c36cd3afa8ff84471447a7bce9bdd6af4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:36:07 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wsvcdtmhnboemv2ky3cjnmxzhq3m2ox2r74ei4kepj545g65nl2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z b4aa21cd87685c46574ac6c496b2f93c36cd3afa8ff84471447a7bce9bdd6af4

(this sample)

Formbook

Executable exe 8067539c7f15318bf8e93b32e339c7236e3b242e8d56637f2c64f6d01c83b3c9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8067539c7f15318bf8e93b32e339c7236e3b242e8d56637f2c64f6d01c83b3c9
  
Dropping
Formbook

Comments