MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26f2fc802dd60b8c1bd8bc7a94e61bdadb5082605b91871399f772ca6379c661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26f2fc802dd60b8c1bd8bc7a94e61bdadb5082605b91871399f772ca6379c661
SHA3-384 hash: f2a46876c1a1d436d1f69d3e28e34b742351a653333f098e342a1809839695191700dac42fd984d1f2f9e463973606c7
SHA1 hash: e1a94601287faa64dae6f48f991dc4c585fca87a
MD5 hash: a30be98f50fe10828b04eca5e6febe06
humanhash: steak-queen-earth-johnny
File name:Purchase Order-070POR044127.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:608'857 bytes
First seen:2021-05-09 14:19:25 UTC
Last seen:2021-05-09 14:22:54 UTC
File type: r00
MIME type:application/x-rar
ssdeep 12288:632/EwzwS+b/28HO720Z+VGUUxnwrE5fOWW0ZoddqhXp:63Uv0NC1Fb/xngQFOddqhXp
TLSH F5D423858421F3EA9C45FC5E6915E34F664892C1BFF3CCA1A402021AB97DFDA3C86767
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email (T1566.001)
From: "Eby | Valtronics DWC <eby@valtronics.ae>" (likely spoofed)
Received: "from valtronics.ae (unknown [45.137.22.71]) "
Date: "9 May 2021 05:46:15 -0700"
Subject: "RE: Purchase Order-070/POR/044127"
Attachment: "Purchase Order-070POR044127.r00"

Intelligence

File Origin
# of uploads :
2
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26f2fc802dd60b8c1bd8bc7a94e61bdadb5082605b91871399f772ca6379c661/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-05-09 03:55:06 UTC
File Type:
Binary (Archive)
Extracted files:
33
AV detection:
18 of 46 (39.13%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e3zpzabn2yfyyg6yxr5jjzq33lnvbataloiyoe4z65zmuy3zyzqq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/26f2fc802dd60b8c1bd8bc7a94e61bdadb5082605b91871399f772ca6379c661

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 26f2fc802dd60b8c1bd8bc7a94e61bdadb5082605b91871399f772ca6379c661

(this sample)

Formbook

Executable exe 1012fd502b2b0f81c21293efaf6b1f012693dc485690e4b8dda25dfa4c7538d9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1012fd502b2b0f81c21293efaf6b1f012693dc485690e4b8dda25dfa4c7538d9
  
Dropping
Formbook

Comments