MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb
SHA3-384 hash: 7fd4c703ebc22f25c5a598dc76e2eec32c9103c4a0911a217b202500d3c9755578abe7f2547a2768ea15c907e64cc995
SHA1 hash: 5f5cce0da62687612bff866d5b762b34b3b0ba0b
MD5 hash: 116573e71ecc3490abfbfc10635dae99
humanhash: dakota-wyoming-undress-diet
File name:PO 9300429038.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:900'627 bytes
First seen:2021-04-09 08:45:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:tVcw+8DyB2u89SO0mfAhojauUp3nB6RlO/KlO:tL+239SpmfAhomP3L/P
TLSH 711533714DFE317C5F09EAA40AAF578FB2BD9BC370DCE011019929CD439B428A6165EE
Reporter GovCERT_CH
Tags:FormBook

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1137.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.21241.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 04:52:40 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ap4sobtssviufdxkdal5v3qeuh5b7f5cdqz2fozzkex3ia2mmtvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 03f92706729551428eea1817daee04a1fa1f97a21c33a2bb39512fb4034c64eb

(this sample)

Formbook

Executable exe 3f1baf04b23987c2ab3094dc23c78ad98e1174e91d35325b40210c95c408ff15

  
Dropped by
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f1baf04b23987c2ab3094dc23c78ad98e1174e91d35325b40210c95c408ff15
  
Dropping
MD5 52b1e3e68ebb92c027c4818898eb24e2

Comments