MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa1fddbcadc03ecd811cf80312ddb450a75061bf1f31d9b35ddfa4691f9ce545. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa1fddbcadc03ecd811cf80312ddb450a75061bf1f31d9b35ddfa4691f9ce545
SHA3-384 hash: cb781c789e98a53ed82ba6a7bba2fb9005a747897fbba326709bc175a7737ff65f2f55c1eb1acbef96f549f2711b519c
SHA1 hash: a7d46e360a0bd8c3d2625b7c8649137527a9e8bc
MD5 hash: 5dc6d607790df6fb670e0f161d2c7d89
humanhash: bravo-fourteen-july-juliet
File name:Manifesr Scan Copy PDF.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:397'010 bytes
First seen:2020-08-19 05:16:04 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Ef/n6ZhNjDeSapQW6fDnKZ2prXymjrTbqKb4kIF8:Y6Zh3ap6f7bzymjrnWkIm
TLSH F084230F35EC0E26188E67621B6F446F112FFCFC864B36020E0292759827DBB63759A7
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email
From: Muhammad Billal Hossain <mail@info.compramostucoche.es>
Received: from info.compramostucoche.es (unknown [103.133.106.216])
Date: 18 Aug 2020 22:15:35 -0700
Subject: Manifest
Attachment: Manifesr Scan Copy PDF.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa1fddbcadc03ecd811cf80312ddb450a75061bf1f31d9b35ddfa4691f9ce545/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-19 05:17:04 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ip53pfnya7m3ai47abrfxnukctvayn7d4y5tm2536sgsh444vcq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fa1fddbcadc03ecd811cf80312ddb450a75061bf1f31d9b35ddfa4691f9ce545

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 fa1fddbcadc03ecd811cf80312ddb450a75061bf1f31d9b35ddfa4691f9ce545

(this sample)

Formbook

Executable exe 66a51591c6b5e01a8aa9f8db61e81d2508b3a6535d7c7a53c501f35093b28fa4

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 66a51591c6b5e01a8aa9f8db61e81d2508b3a6535d7c7a53c501f35093b28fa4

Comments