MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3a6763c171267bdc605da07544668b969514e5f0da6849ffe51f8c3e1fab322. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3a6763c171267bdc605da07544668b969514e5f0da6849ffe51f8c3e1fab322
SHA3-384 hash: 5feba321c5b9d66c102029c7c7b572c1e9ce73416f119dd4211ea9d923bf7fe90b2a14dab53617ca91f516d579946d84
SHA1 hash: c7d696e084022c2691adbdda5ff28e78dbf22259
MD5 hash: 8d6016d758bf9f0e05355a187d9c7e52
humanhash: virginia-texas-network-california
File name:zmc.hanyangorder.img
Download: download sample
Signature FormBook
Create hunting rule
File size:1'769'472 bytes
First seen:2020-08-05 09:22:12 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:JTkwYwztS2lj/afhOHV71kzgTctpwKpwvooOy:6xQh+5OpegTctpRpFoOy
TLSH FC85E0A03984DF9DC86E0F3034236810EBE1AD161E45F64FBCDA76EC1BB66864E1671D
Reporter abuse_ch
Tags:FormBook img


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: alnassar.com.sa
Sending IP: 162.244.93.110
From: zmc.hanyang <zmc.hanyang@vip.163.com>
Reply-To: zmc.hanyang@vip.163.com
Subject: Re: RE: zmc.hanyang new order
Attachment: zmc.hanyangorder.img (contains "TXipfH0fAM4wXWT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3a6763c171267bdc605da07544668b969514e5f0da6849ffe51f8c3e1fab322/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:24:09 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yothmpaxcjt33rqf3idvirtixfuvcts7bwtijh76kh4mhyp2wmra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3a6763c171267bdc605da07544668b969514e5f0da6849ffe51f8c3e1fab322

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

img c3a6763c171267bdc605da07544668b969514e5f0da6849ffe51f8c3e1fab322

(this sample)

FormBook

Executable exe d61447d5653bc8e81c91e487864e2ea56fe6700fa720e4b6b07040c9b50db868

  
Dropping
MD5 fc1347579ab92de9bcf41d7bfae1b919
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d61447d5653bc8e81c91e487864e2ea56fe6700fa720e4b6b07040c9b50db868

Comments