MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd38bdeb8e3a1fcc887c2b5d65a764524fb8de13f989e1597f9de18e3f7ce985. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd38bdeb8e3a1fcc887c2b5d65a764524fb8de13f989e1597f9de18e3f7ce985
SHA3-384 hash: f832212bff514310ec5a8298ac8b8ca9687c552db72b475783945591e04b3887ad6a4022b1034129fe8ab4c86d33b076
SHA1 hash: 547a012ca4af0de3ff5fb15b765b1139356e48a2
MD5 hash: 8e070181339788110635f54d6373c028
humanhash: purple-lamp-west-ohio
File name:RFQ116236SO929198.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:532'849 bytes
First seen:2020-10-19 07:30:46 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:7OVJswvclBgub9h1X5BJ+k0/ADQIE0F/NrSv5yR7n+6b5:7Qawvcliub71Xg/AzbTrSkv5
TLSH FDB423C9EBB035214CA5787F5AB9B430EC18D7AC05B3184FD4BB0EEDC542A601A76EE4
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: server.blakecorporations.com
Sending IP: 199.250.204.180
From: Sultan M. Mohideen <upply@cn-goldenharvest.com>
Subject: RFQ#116236/SO#929198 - Request for Quote- BAFFLES
Attachment: RFQ116236SO929198.rar (contains "RFQ#116236SO#929198.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd38bdeb8e3a1fcc887c2b5d65a764524fb8de13f989e1597f9de18e3f7ce985/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 02:14:38 UTC
AV detection:
2 of 48 (4.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xu4l324ohip4zcd4fnowlj3ekjh3rxqt7ge6cwl7txqy4p345gcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bd38bdeb8e3a1fcc887c2b5d65a764524fb8de13f989e1597f9de18e3f7ce985

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar bd38bdeb8e3a1fcc887c2b5d65a764524fb8de13f989e1597f9de18e3f7ce985

(this sample)

Formbook

Executable exe e232dc56a916d659961271caf129b47c5fa561f71ecff17f6c96801cd7b50820

  
Dropping
MD5 f28ea02d6832f74161c323d8345670b5
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e232dc56a916d659961271caf129b47c5fa561f71ecff17f6c96801cd7b50820

Comments