MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a
SHA3-384 hash: 0b640593c6454a63392bb6d2b1947197cb59ffc0df66686da90106d5d53fcb688098fb998b5349c8c229e02857780f44
SHA1 hash: f412b5ad356c62d190f2d95ffaf7f15ca881489b
MD5 hash: 91c7ed04f7cc1b8d29673fc66aa71e20
humanhash: tennis-lima-butter-lake
File name:01308.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:262'245 bytes
First seen:2020-08-13 10:33:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:dbuC7j7eTLBoJRQ1OxY0RdHAgueC+wKnRk+ecVHQzVEY:dbJeT1+G0rBDGKzeIQzV
TLSH 694423A4315DEFCE0C8C160AAEA105E1E4DF899C57395DA34A21E2F17E0B74DF87E1A1
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.erstisorof.com
Sending IP: 104.168.242.143
From: ACCOUNT <info@erstisorof.com>
Reply-To: ACCOUNT <mailreply01@mail.com>
Subject: STATEMENT OF ACCOUNT
Attachment: 01308.zip (contains "01308.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Formbook-7399661-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:35:05 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2itkf6pljlargfexrixxmy4hzxml545liivtg6k6ha2zrrhj7fva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip d226a2f9eb4ac11314978a2f766387cdd8bef3ab422b33795e383598c4e9f96a

(this sample)

Formbook

Executable exe d5231355835fc25fb6f9923639331084ff0ae602929793c263e01eda38d2fa1b

  
Dropping
MD5 25a53b5fdbe19e341d674b816175d4c9
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d5231355835fc25fb6f9923639331084ff0ae602929793c263e01eda38d2fa1b

Comments