MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e32c0cf76b1a007be93704a397478194774d0929841d91659ba37b9199462870. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e32c0cf76b1a007be93704a397478194774d0929841d91659ba37b9199462870
SHA3-384 hash: fee93191b0a0581f72349bf069af8af430f0689f66a09238acadb4e68040266b432a61ec6fba5db72311f5b617090c0b
SHA1 hash: a1d34502ecf1745dcb4c216eb2cd6f1abbf89e59
MD5 hash: 93616bde58e325b7c5869b2585b180c3
humanhash: emma-romeo-lemon-golf
File name:new order.Z
Download: download sample
Signature Formbook
Create hunting rule
File size:251'558 bytes
First seen:2020-08-18 05:35:27 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:QHRusKHPETBHCdtR2W3afmXXM1YSvkxAWTJXHbxJS13:QHRusCMNHu2dgXMuEkx7N7Q3
TLSH 063423E498964989F28DD1040CB3897997D903E366241FBA1132C972BD3FA78BDF85D2
Reporter cocaman
Tags:FormBook z


Avatar
cocaman
Malicious email
From: Sales<sales06@tgybio.com>
Received: from tgybio.com (unknown [62.113.215.235])
Date: 17 Aug 2020 17:44:27 -0700
Subject: LATEST ORDER
Attachment: new order.Z

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e32c0cf76b1a007be93704a397478194774d0929841d91659ba37b9199462870/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 05:37:03 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mwaz53ldiahx2jxasrzor4bsr3u2cjjqqozczm3un5zdgkgfbya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

z e32c0cf76b1a007be93704a397478194774d0929841d91659ba37b9199462870

(this sample)

Formbook

Executable exe 14fbe673ff6885803dc45ef4966a7632d47fe9c930572b505691876c082f8322

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 14fbe673ff6885803dc45ef4966a7632d47fe9c930572b505691876c082f8322
  
Dropping
Formbook

Comments