MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b68166aaada3fe461c3529364e3e8c66c28377617e591f0ecaa240d3cfd4eb97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b68166aaada3fe461c3529364e3e8c66c28377617e591f0ecaa240d3cfd4eb97
SHA3-384 hash: 2ffc73e6bdfa708d27fd9f32c9847b9ca1fdfa4d4c0a27f601364862b209dc61a23448743b586c8bb5fda51e955ddc8a
SHA1 hash: 72317e26432dcd1b25dc3e839dc8c137f777b770
MD5 hash: e218c2419cc41d137d4936168be26bae
humanhash: fourteen-paris-idaho-nineteen
File name:RFQ-PO04635AZ323.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:274'855 bytes
First seen:2020-06-16 05:08:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:kYvOPUbDgkKt1B59vCLt8E5Ffr9RL8gJZubvNL5D/Y:Ndg1j59vG8E5tRRoNNw
TLSH 03442374CE57E9592913B42C300AEF5A136DE0CEB6D1FA76084B1DF4F144EA881E0E6E
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: thaimartin.co
Sending IP: 111.90.145.52
From: Dong Hee Han <pearldenthandonghee@gmail.com>
Reply-To: patbonnantakui@gmail.com
Subject: RE: RFQ-PO04635AZ323
Attachment: RFQ-PO04635AZ323.rar (contains "RFQ-PO04635AZ323.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 05:10:08 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w2awnkvnup7emhbvfe3e4pumm3big53bpzmr6dwkujanht6u5olq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar b68166aaada3fe461c3529364e3e8c66c28377617e591f0ecaa240d3cfd4eb97

(this sample)

FormBook

Executable exe f310aa4f6cb0b3c3d237d13640594dd0a06f8c42ab5ecd1cba3daecc860129bf

  
Dropping
MD5 93de480dde266435aaac2a9c0ff59c1e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f310aa4f6cb0b3c3d237d13640594dd0a06f8c42ab5ecd1cba3daecc860129bf

Comments