MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c98bdf6a043d0860dad2f0c531866a422b3e19837aacd254c9c6f97910c37b7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c98bdf6a043d0860dad2f0c531866a422b3e19837aacd254c9c6f97910c37b7b
SHA3-384 hash: 4857ebd6233d1f30eabde869250a66314ec886a52f381603bd1118266df42774674388b233ad93da04e23cb30e558c21
SHA1 hash: 7516e031acd90ea5a7a6f66ffa5e8b6d3eca996d
MD5 hash: 72a0ff0809e0b5be14aabce583f7ccfc
humanhash: oranges-ohio-three-helium
File name:ORDRE9047EAR.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:512'793 bytes
First seen:2020-10-26 14:19:29 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:8mHHZsKkgjfTOBsgzDEz9RVNrvancA39KLpbFQLT:BwgLTO9DEzTVlVANmpbSLT
TLSH CAB4235CC04A94F57AFA3B59E16CAACD704B0BE0863C099DE5A8540E852785E3FDDF38
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: dlveltex.co
Sending IP: 111.90.140.219
From: Chery Ch <Cherych@dlveltex.com>
Subject: Attached selected items and confirmed copy of quotation for your reference.
Attachment: ORDRE9047EAR.rar (contains "ORDRE9047EAR.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c98bdf6a043d0860dad2f0c531866a422b3e19837aacd254c9c6f97910c37b7b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 07:21:14 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zgf562qehuegbwws6dctdbtkiivt4gmdpkwnevgjy34xsegdpn5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar c98bdf6a043d0860dad2f0c531866a422b3e19837aacd254c9c6f97910c37b7b

(this sample)

Formbook

Executable exe b40a41c9ee9ed3cc2a18968a900d160b0682e6a3e7b824a953a1e5ca88e6f524

  
Dropping
MD5 bfa45b960782fb1c6a1c49e253b7147b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b40a41c9ee9ed3cc2a18968a900d160b0682e6a3e7b824a953a1e5ca88e6f524

Comments