MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdab754221a0ceb30ee7a0d01840223769395fb3d777ca126410274d2dc76abe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdab754221a0ceb30ee7a0d01840223769395fb3d777ca126410274d2dc76abe
SHA3-384 hash: a3ba2de1782dad6a718b80dab6cbffd25698666aaa96162eea0ee3da1ceb361ad2da129adf720efbd4be9fcbd7f7d8ce
SHA1 hash: a6d493ad0a6dc419c5966790aca112a737f8a4eb
MD5 hash: 3c83ba0f79d0785ad84ce8e704bc9a7d
humanhash: texas-steak-shade-cardinal
File name:PO-23562TZ232.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:1'051'962 bytes
First seen:2021-01-19 07:53:51 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:LVTKttcFLr3UWUy6Jmi0Isu/HBpdxMit2yVVMeQFOcNA:1mSfr6JmLu/Bpl2WHH8A
TLSH AD2533C87001E91C2676EDDEBE6485112E7FB740B33C184064F24EE3AB49BA56175EF9
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: cbdjo.cam
Sending IP: 111.90.159.32
From: Jina Choi <inform@sungdomc.co.kr>
Reply-To: export@sungdomc.co.kr
Subject: RE:PO-23562#TZ232
Attachment: PO-23562TZ232.rar (contains "PO-23562#TZ232.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27572.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdab754221a0ceb30ee7a0d01840223769395fb3d777ca126410274d2dc76abe/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:54:10 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xwvxkqrbudhlgdxhudibqqbcg5utsx5t2534uetecatu2lohnk7a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bdab754221a0ceb30ee7a0d01840223769395fb3d777ca126410274d2dc76abe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar bdab754221a0ceb30ee7a0d01840223769395fb3d777ca126410274d2dc76abe

(this sample)

Formbook

Executable exe cb2e173430a404a7cf52a54db1ff96b0de6eed1b8953d96b57e2780e45e71db9

  
Dropping
MD5 357a14cfd77aeee6ccdefd6306790b6e
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cb2e173430a404a7cf52a54db1ff96b0de6eed1b8953d96b57e2780e45e71db9

Comments