MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de9384dc28357c778aca980bb9d5fa801a6ee2e6e94407b5a41c5e8e63943669. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de9384dc28357c778aca980bb9d5fa801a6ee2e6e94407b5a41c5e8e63943669
SHA3-384 hash: 37a51be78509ea0d98de83a696d9131e91bbeb6a5377f7c9df725087e68b874984980327a9a97b53db2366647b8317d7
SHA1 hash: 7d30586cd913260d5b9f178ef6603c1d97520dac
MD5 hash: 62541465e306733f69102cc31a7189fa
humanhash: alaska-sierra-kansas-saturn
File name:ORDER_3901.rar
Download: download sample
Signature FormBook
Create hunting rule
File size:268'301 bytes
First seen:2020-06-17 05:39:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:cIGvNXVJAuFJFtUslXJj5ICV34LjQGPifHKyXH/8:c71XViuFJrU4Z5INfRPIqyXH/8
TLSH CD44236531E7A6AAE20A101F8F0B53DDF1D9836D0C3E7F5B85D41FD4689E6A643FA008
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: yuntong-batt.co
Sending IP: 111.90.141.203
From: Gibson roman <G.roman@yuntong-batt.co>
Subject: RE: RE: ORDER
Attachment: ORDER_3901.rar (contains "ORDER_3901.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:41:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=32jyjxbigv6hpcwktaf3tvp2qang5yxg5fcapnnedrpi4y4ugzuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

rar de9384dc28357c778aca980bb9d5fa801a6ee2e6e94407b5a41c5e8e63943669

(this sample)

FormBook

Executable exe f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557

  
Dropping
MD5 826fe6a763bcf2bc7746cb532cce187b
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f34f4e3d8e9c1ec1d066d75d07f3d93c70931d6a54d736dc12f83b8277db2557

Comments