MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df9b2ff7fb588814d04dd9205bc1e53b95d74536eb3025b9aadf01cd6f78f3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FormBook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df9b2ff7fb588814d04dd9205bc1e53b95d74536eb3025b9aadf01cd6f78f3ec
SHA3-384 hash: 8010d961d1c49a88d8f6cf953a68ff1ec6f19d801913fc53c8237a71f4d978628170d32532d1b6eb99d0d31e74b4c5ad
SHA1 hash: d2c1ec60afab73f56274a56dd3f0869547773e0a
MD5 hash: 06801157d5957d0c1eb6178ec32f16c6
humanhash: oklahoma-cardinal-lamp-pluto
File name:PMT.zip
Download: download sample
Signature FormBook
Create hunting rule
File size:433'796 bytes
First seen:2020-08-06 07:56:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:pc5BmklOafimfoQCS+sWDstLWsQuHyjrqC6qlV/2m2ZczYT93EeeRxOzhRut:pGxfico++7+SuY3yyzYT93FeRQzb4
TLSH 549423D6C6A53C7F2E73C3046C5B51C8BB02618795916135BF4C2ECA077CA2A7CB6E52
Reporter abuse_ch
Tags:FormBook zip


Avatar
abuse_ch
Malspam distributing FormBook:

HELO: 162-241-205-158.unifiedlayer.com
Sending IP: 162.241.205.158
From: The Hongkong and Shanghai Banking Corporation Limited <server@blueinnovations.solutions>
Subject: PMT Advice - Advice Ref:[GA1816101630] / Priority payment / Customer Ref:[ENERPARC7392018]
Attachment: PMT.zip (contains "PMT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df9b2ff7fb588814d04dd9205bc1e53b95d74536eb3025b9aadf01cd6f78f3ec/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 07:57:58 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=36ns7573lcebjucn3eqfxqpfhok5orjw5myclonk34a4233y6pwa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df9b2ff7fb588814d04dd9205bc1e53b95d74536eb3025b9aadf01cd6f78f3ec

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

FormBook

zip df9b2ff7fb588814d04dd9205bc1e53b95d74536eb3025b9aadf01cd6f78f3ec

(this sample)

FormBook

Executable exe 327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d

  
Dropping
MD5 057d2611247e86ada3d280763b21aa5e
  
Dropping
FormBook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 327bc1ad9fc793811e5da6cb3553b7dca05c8a48d8060fc94015339ee805851d

Comments