MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3c85c05bd69d14fca6d11e35defec4cb7e76c16a5da061a3d7a0ee48e5c5c896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 5
| SHA256 hash: | 3c85c05bd69d14fca6d11e35defec4cb7e76c16a5da061a3d7a0ee48e5c5c896 |
|---|---|
| SHA3-384 hash: | f72ae88cd97c2303f94f0f089ef6ced1ad20d517441c7d329dda6bbf18a4db56f908f5e979c5feceff9b63c01ae93e51 |
| SHA1 hash: | 64b09b8fd8a726c6b170ddfdeb9e5a853d3afa45 |
| MD5 hash: | 854c15f09d9e26fed6007e310624873c |
| humanhash: | maine-kitten-nineteen-pip |
| File name: | shipping document.r01 |
| Download: | download sample |
| Signature | Formbook |
| File size: | 711'117 bytes |
| First seen: | 2022-07-05 11:17:05 UTC |
| Last seen: | Never |
| File type: | r01 |
| MIME type: | application/x-rar |
| ssdeep | 12288:XJKqbrkZjboo62X6fslCAxqCf/Gef/THr7YaadFAy3Uj/McuEOQ2S4pVLOaa5hgW:XJKqXm8ffAICf/GefrHxsAdDMWOm4pV8 |
| TLSH | T16DE423E8A24888366BF865A184E0FB7973287B89044C5B9BB55D5D1387CFF7F09264F0 |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Reporter |  cocaman |
| Tags: | FormBook r01 Shipping |
cocaman
Malicious email (T1566.001)From: "agencqhd@hoscogroup.com" (likely spoofed)
Received: "from hoscogroup.com (unknown [202.55.133.137]) "
Date: "5 Jul 2022 03:37:36 -0700"
Subject: "RE: Shipment Docs"
Attachment: "shipping document.r01"
Intelligence
File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2022-07-05 08:11:48 UTC
File Type:
Binary (Archive)
Extracted files:
48
AV detection:
20 of 40 (50.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Dropping
Formbook
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.