MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfedaced2bce8a02b0462a2d3bef9026e6e7e6bc3886ac0397894839928c9733. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfedaced2bce8a02b0462a2d3bef9026e6e7e6bc3886ac0397894839928c9733
SHA3-384 hash: fa974569bd485a3120468099c92132bd15ae877ce64ce4fe5a5adaa57c1a7d1fc4f20b24667f80e30f5678f418e8e4be
SHA1 hash: 81440edc736a554f33037c92bac00d075bbf1d2b
MD5 hash: 506c9b8ee12e7de579840117c8d9cd8e
humanhash: autumn-moon-florida-stream
File name:ORDER-8043222VN.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:448'239 bytes
First seen:2020-08-13 05:54:07 UTC
Last seen:2020-08-13 06:16:43 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:H9O3FbkNo0daZrKGvr/tpWtXsggVCY+wLjW2:W2e0Er/tpWtcggVCY+wLp
TLSH 17942301D7D10CA3D675A2511E2C86C72ECA25E368C0A7E12F1ACF586F782C59B9E4DF
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

From: "Smarth" <mtrebejo@sanpablo.com.pe>
Subject: Request for Quote 8043222
Attachment: ORDER-8043222VN.rar (contains "ORDER-8043222VN.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfedaced2bce8a02b0462a2d3bef9026e6e7e6bc3886ac0397894839928c9733/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 05:56:06 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7w2z3jlz2fafmcgfiwtx34qe3topzv4hcdkya4xrfedteums4zq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cfedaced2bce8a02b0462a2d3bef9026e6e7e6bc3886ac0397894839928c9733

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar cfedaced2bce8a02b0462a2d3bef9026e6e7e6bc3886ac0397894839928c9733

(this sample)

FormBook

Executable exe fad88fa44fea006090c7d5dae844338afcd1b7c0de32b31ee4e074fcb9474f41

  
Dropping
MD5 7f3751e9c6c24db10e58a4e06c5e07b4
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fad88fa44fea006090c7d5dae844338afcd1b7c0de32b31ee4e074fcb9474f41

Comments