MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd2e850246fd6c6b01e3debeb9538411daf174a7301d2c955d990c99f2432ddd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd2e850246fd6c6b01e3debeb9538411daf174a7301d2c955d990c99f2432ddd
SHA3-384 hash: 1542853814c5467befd2971ba444526665c217d2272444336bba837e85579b8e62cd57ece282062f63902847f5df16e0
SHA1 hash: afe5dfce70ffc22bb7bd085970e1616a52694127
MD5 hash: 06f1276ddb20a5de4847b9e1da3ac5fb
humanhash: uranus-yellow-juliet-bacon
File name:SwiftBRT.Scan.pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:295'241 bytes
First seen:2020-10-07 04:53:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:ZWImbiFLw4qfx+XSUfq3j+qBygMGLisr7dsKnREaj66bafSqEI+N6XB:ZWImicrxvUfqTFLFr7zxufSGB
TLSH E4542353B9AB744B934420CBE4D58D5D52AEEA60D3C9B02E36B1724E27C0ED1CF3958B
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: totyhai
Sending IP: 45.127.62.2
From: Paz Edgar <eileen@joyceswift.gq>
Subject: RE:RE:RE:Balance Payment
Attachment: SwiftBRT.Scan.pdf.rar (contains "SwiftBRT.Scan.pdf..exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd2e850246fd6c6b01e3debeb9538411daf174a7301d2c955d990c99f2432ddd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 19:30:16 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uxikasg7vwgwapd327lsu4echnpc5fhgaoszfk5tegjt4sdfxoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fd2e850246fd6c6b01e3debeb9538411daf174a7301d2c955d990c99f2432ddd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar fd2e850246fd6c6b01e3debeb9538411daf174a7301d2c955d990c99f2432ddd

(this sample)

Formbook

Executable exe f9b5791e5556abf20bf540734de904ea4a0508005071f43531a1347f7fdcce08

  
Dropping
MD5 7e813592910ada66e23d62851c6138fc
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f9b5791e5556abf20bf540734de904ea4a0508005071f43531a1347f7fdcce08

Comments