MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5f7b7c4b69c7106b7fc41f6634ae4f3b70b80f4b7233a7bd27a4f9f10ddab61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5f7b7c4b69c7106b7fc41f6634ae4f3b70b80f4b7233a7bd27a4f9f10ddab61
SHA3-384 hash: 7e9aa014303d5a2232ac76aef75d369bb696f9e2b0523c470b395ee513f81c5e70c56d7fdcfc4047c499b3408dac6007
SHA1 hash: 6cb1e766f583844c528cefb8cb31188404e97103
MD5 hash: 6c748dc4ec842c5b9702c38e73b6d5d1
humanhash: aspen-seven-butter-magazine
File name:PO8012802.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:348'851 bytes
First seen:2020-07-29 11:50:23 UTC
Last seen:2020-07-29 18:01:07 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:V+aa78uKt5+DM8O5nFd2CcjX5woo2MW8YBHTagutF6xJ3yLLxwruIV/1ieWjy4ss:VoM+wF5nD+X5woJghnIC3xwTV/0jo27J
TLSH E77423D459ED7167C3D2BFDB330A88CF45036217EB9E6A28CA10EA02C566B5F952374C
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: fluigent.com
Sending IP: 95.211.253.210
From: Nour Yakdi <nour.yakdi@fluigent.com>
Subject: ORDER
Attachment: PO8012802.zip (contains "PO8012802.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.62857.19350.30796.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5f7b7c4b69c7106b7fc41f6634ae4f3b70b80f4b7233a7bd27a4f9f10ddab61/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:52:07 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2x33prfwtryqnn74ih3ggsxe6o3qxahuw4rtu66spjhz6eg5vnqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip d5f7b7c4b69c7106b7fc41f6634ae4f3b70b80f4b7233a7bd27a4f9f10ddab61

(this sample)

FormBook

Executable exe 26bf78c520963df1285a4d4fc240e9a9d7ce5b61f02a99416e618514c0f83b22

  
Dropping
MD5 59aa3a99cc596662dfaee80564849282
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 26bf78c520963df1285a4d4fc240e9a9d7ce5b61f02a99416e618514c0f83b22

Comments