MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cac54be6a4bbf126fece5abd6809961b7add5e7d9a4e9d62f364a31f8b53655b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cac54be6a4bbf126fece5abd6809961b7add5e7d9a4e9d62f364a31f8b53655b
SHA3-384 hash: b73e2ba7bb1dbc062bc380e7471d15a2b61efd66591570a4bc839879ea5da197803569917c7ca76a81322474a1f31130
SHA1 hash: 200169ec44e5a596da52beabaa72fccaad026112
MD5 hash: 36ac27a313643e37968f867a060ca8c3
humanhash: jig-eight-pip-sodium
File name:Bank Receipt.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:274'100 bytes
First seen:2020-10-23 08:53:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:h5If6P35sYmE9oI+EkwFQAcA5aRVO180nyDtrjwA0p:h5If6hszs/kAQ5A5aRZ0yDtrjWp
TLSH 2444235D7AC46A3AC63B1EAE9984BB57C5D34F25E8769CAB05DAD010C372C31F1CA09C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: ultimatecircle.com.my
Sending IP: 95.211.208.23
From: sales@ultimatecircle.com.my
Subject: RE: PAYMENT INSTRUCTIONS
Attachment: Bank Receipt.zip (contains "Bank Receipt.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21008.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cac54be6a4bbf126fece5abd6809961b7add5e7d9a4e9d62f364a31f8b53655b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 07:11:23 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlcuxzvexpysn7wolk6wqcmwdn5n2xt5tjhj2yxtmsrr7c2tmvnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip cac54be6a4bbf126fece5abd6809961b7add5e7d9a4e9d62f364a31f8b53655b

(this sample)

Formbook

Executable exe b7d55f5145ac91a9b2e9d1b98f65bf6844248ebd6612be241e2fe5755dcf0733

  
Dropping
MD5 87472467d8185998553cc37afce80bbd
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7d55f5145ac91a9b2e9d1b98f65bf6844248ebd6612be241e2fe5755dcf0733

Comments