MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd57c67e53965bde0c081c50965441c7067fc0986ec102d5f9a4afd40c24b849. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd57c67e53965bde0c081c50965441c7067fc0986ec102d5f9a4afd40c24b849
SHA3-384 hash: d3f0b54674f2a693581f72d89e7f3facb38a9b46a3aa3aa6513cac3fb13b9b1cce70c6b9cdca718244d1742bbbead5ee
SHA1 hash: 00a247d61be06ea32c958791c7900856929c6258
MD5 hash: 98c0e7c624b2a46c169d97acc734ac16
humanhash: illinois-aspen-happy-zulu
File name:New_Order.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:505'656 bytes
First seen:2020-08-17 19:13:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:wGQfEUWGBpCJ07qHQT0LESZyAe58kBgxt8a92CTnRLxaI:1QbeFw43+MxmO2CrRLxaI
TLSH DEB423221619DAF439430DAE3A23E2791FE016F957744D6692731E7EF5ECA2320432F5
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: sg1.productsgood.com
Sending IP: 45.125.192.99
From: Aminu Umar <support@haisokbr.go.th>
Subject: Re: Re AW: AW: Order
Attachment: New_Order.rar (contains "New_Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd57c67e53965bde0c081c50965441c7067fc0986ec102d5f9a4afd40c24b849/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 19:15:04 UTC
AV detection:
23 of 47 (48.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zvl4m7stszn54daidrijmvcby4dh7qeyn3aqfvpzusx5idbexbeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd57c67e53965bde0c081c50965441c7067fc0986ec102d5f9a4afd40c24b849

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar cd57c67e53965bde0c081c50965441c7067fc0986ec102d5f9a4afd40c24b849

(this sample)

FormBook

Executable exe 2ad145ebeae4ff20eeb893b16658fe43d7557f30c746edc355a5dceb393bf8bb

  
Dropping
MD5 28c499881a979f0fc95c18d2a1d39bcc
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2ad145ebeae4ff20eeb893b16658fe43d7557f30c746edc355a5dceb393bf8bb

Comments