MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de18faef6d6a2db45bb9dc42e1982fcd7c7be99ca851b9427f1b9f38b0cad770. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de18faef6d6a2db45bb9dc42e1982fcd7c7be99ca851b9427f1b9f38b0cad770
SHA3-384 hash: 5283f7228fb5887c9a1d5cbc004d9a13627ad54422bccf69070202785c4efe79a4e8dd5843da9772fff2add6292cdb2d
SHA1 hash: d7bc3f5e179bfc1ea956d8e82fbedc3c28bf80f4
MD5 hash: 768065fe0f1e66cbf441222ad7cb5b1b
humanhash: fourteen-uniform-kentucky-california
File name:оферта за поръчка.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:712'877 bytes
First seen:2020-10-23 09:28:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MHZatdJF+LuzfZmB5CmRPaNDdHz2Wc8xSXuRen/0P:MHZKhzxmB5COPuT2WcMF
TLSH 0BE42366FB7C01A2CAE0224C530A599EB5187AF465031F856D73FE47826736FD6083AF
Reporter abuse_ch
Tags:BGR FormBook geo zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.freespirittours.net
Sending IP: 216.144.241.158
From: Danke Voraus <epugnant@groupe-rdt.com>
Subject: Re: Re: оферта за поръчка
Attachment: оферта за поръчка.zip (contains "оферта за поръчка.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.31356.4291.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/de18faef6d6a2db45bb9dc42e1982fcd7c7be99ca851b9427f1b9f38b0cad770/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 09:16:04 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ympv33nniw3iw5z3rbodgbpzv6hx2m4vbi3sqt7doptrmgk25ya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip de18faef6d6a2db45bb9dc42e1982fcd7c7be99ca851b9427f1b9f38b0cad770

(this sample)

Formbook

Executable exe cc15e8a9e04355389815d8a7be4c34746c87a2a9d672e426c01b00ad0a583069

  
Dropping
MD5 a7010d8356bb1135a231084f07e99d56
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cc15e8a9e04355389815d8a7be4c34746c87a2a9d672e426c01b00ad0a583069

Comments