MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9
SHA3-384 hash: b95fb01ffbcf8b83a61eb5372f2910374fcb1fea5367f3b0ae7d97de5413d9dcddca732d8f3d524da254ea1d341b271b
SHA1 hash: 272310be1a86e9bca70b9e395ccd0492a86d113c
MD5 hash: aaeb4fbfd515cc544fff74cc2803526d
humanhash: fanta-coffee-ceiling-three
File name:Shipping Documents.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:639'861 bytes
First seen:2021-03-22 07:44:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:zsWR0EvUpBrjVurGTxm/Cz0r7U/Juu2m+AfAjcW0V2xuUUHn+hSU0gWiNN:zTR0jpVorGlmBSJuv4IjcW0SuX+hST8
TLSH 8FD423529A1A33D6785B76BEA3DD0C9614B5C8FF0D09F4B6B0D6DDB8836E4C1900E871
Reporter abuse_ch
Tags:DHL FormBook zip


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: outbound1.byshoma.net
Sending IP: 173.248.157.162
From: DHL SERVICES <info@daraladalah.com>
Reply-To: info@daraladalah.com
Subject: ARRIVAL NOTICE DHL (AWB) Confirm Original Shipping documents
Attachment: Shipping Documents.zip (contains "Shipping Documents.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs789.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21092.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 07:45:09 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=36q6cghwj6korby5uwypqddyes3o3p3hokklf42edaszxaydktuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip dfa1e118f64f94e8871da5b0f80c7824b6edbf677294b2f34418259b830354e9

(this sample)

Formbook

Executable exe 9d897ca451489c0df210b7af398e17348e253d4c57f7308ec7be1b11a8be2243

  
Dropping
MD5 fdb63f87cab7bde1725895e2cec86d1b
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d897ca451489c0df210b7af398e17348e253d4c57f7308ec7be1b11a8be2243

Comments