MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbf51c2c6a8e8d7c0a27cf0a9d4d8677b142826ee4a82aeb721f5c2c6226f8ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbf51c2c6a8e8d7c0a27cf0a9d4d8677b142826ee4a82aeb721f5c2c6226f8ae
SHA3-384 hash: 48162e0316a57100df82e34bf692687d3ddaa6879c25d535cc0d03c29dad6dee467d854d24b519a7bcac1a843420440e
SHA1 hash: 3ff1caa64617c55f58f6630d0f25dfcd40168cf1
MD5 hash: c9f254921a3ae0cfe517c889d1f5e97e
humanhash: bulldog-sixteen-montana-avocado
File name:Quotation3.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:438'179 bytes
First seen:2020-10-21 10:09:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CXo/XpB4aw/Rmh2EuBG47U//YVTMU1m+4tv:CXowaw/fFRMv
TLSH D194231A0825904A2F1D4D65762DC3E23DC33B9B41CB4B358A2DC6E238DB7789DCF996
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: rdns0.hyterm.xyz
Sending IP: 134.209.44.46
From: ALPHONS CHACKO<Purchase5@i-m-s.ae>
Subject: RE: Inquiry RFQ agaisnt ENQ NO-E1503010
Attachment: Quotation3.rar (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbf51c2c6a8e8d7c0a27cf0a9d4d8677b142826ee4a82aeb721f5c2c6226f8ae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 09:23:30 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zp2ryldkr2gxycrhz4fj2tmgo6yufato4sucv23sd5ocyyrg7cxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar cbf51c2c6a8e8d7c0a27cf0a9d4d8677b142826ee4a82aeb721f5c2c6226f8ae

(this sample)

Formbook

Executable exe 3f98571de88f8e13c4197c46d74287d2f0aef827a196ea51cb4b934c6857e04b

  
Dropping
MD5 22655725e4ef7b4ee0f8db5ea8d91cc6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f98571de88f8e13c4197c46d74287d2f0aef827a196ea51cb4b934c6857e04b

Comments