MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9788677576a791ff356282d9def081d36ce4e980fff9f3ba2ad8cc1c9064f1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9788677576a791ff356282d9def081d36ce4e980fff9f3ba2ad8cc1c9064f1b
SHA3-384 hash: 0b04dc76d5d455396c3eb3e54d1dfb845c628a3bcd20f75cc0f65c92cb19ee375f4f017e0540ad0d0633b0e134329ff7
SHA1 hash: d75e54e0300ec94cf5d1b2e94333ba220265c3a2
MD5 hash: 75754b45b084d69e8ce0c2e388f19542
humanhash: johnny-sink-lion-tango
File name:Purchase-order_62297.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:288'097 bytes
First seen:2020-05-15 06:32:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:UhkCtQ/znWu2fkrEXq+TCDNzSpuS/0E4Vz/YEYG6s3V/hMWp/k:Um/cQEaimS0SsRVz/XthMh
TLSH D754222E280FACDF55303C28D23375A2935CB3D14285ABDFB5E122566B9715E448F3EA
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: smtp92.iad3a.emailsrvr.com
Sending IP: 173.203.187.92
From: thanawat@shawpet.com <thanawat@shawpet.com>
Subject: Re: Re: Attached Order List
Attachment: Purchase-order_62297.rar (contains "Purchase-order_62297.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-15 06:35:34 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
19 of 48 (39.58%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xf4im52xnj4r742wfawz33yidu3m4tuyb77z6o5cvwgmdsigj4nq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar b9788677576a791ff356282d9def081d36ce4e980fff9f3ba2ad8cc1c9064f1b

(this sample)

FormBook

Executable exe 836e10c649bce22fed99ea498ea2f36c8d7e832be5be20de60a4f0a13db71ed9

  
Dropping
MD5 a642c44d9cf338869aa602dd8fb3ac35
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 836e10c649bce22fed99ea498ea2f36c8d7e832be5be20de60a4f0a13db71ed9

Comments