MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f9d3c1d19fe95d4302831ddd9a56e248b4bdbb8e44207b03043013a8bf3b494. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f9d3c1d19fe95d4302831ddd9a56e248b4bdbb8e44207b03043013a8bf3b494
SHA3-384 hash: 7f9884b259dfdf6b2a742c9973cfb99711722397e1cbf78f1378d3a99461f3cd776acc1945066e8b4f07348572f355ee
SHA1 hash: b4c477f99c2d4c55bcbb7d0ee16ec0328eaca178
MD5 hash: d92bb204992eedb0e715da316989ff00
humanhash: charlie-seven-potato-bacon
File name:New_Purchase_Order_EK_RA30151_MontJade_Engineering_Co_Ltd_752311.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:449'289 bytes
First seen:2020-12-04 06:30:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:YDFTFkTCMtBZDKqc/DOCzBcEjpvbNOOop+fmHgYG5R2sG:YkvtBMFyCzBcEFJg+f2rGr8
TLSH 6AA42377A89F87D865AB0CB8572CF40B81848B3B6816FAE50952F743AB9057FC07911F
Reporter fabjer
Tags:archive

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.48175.2364.29396.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f9d3c1d19fe95d4302831ddd9a56e248b4bdbb8e44207b03043013a8bf3b494/
Threat name:
ByteCode-MSIL.Trojan.Swotter
Create hunting rule
Status:
Malicious
First seen:
2020-12-02 17:38:04 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6otyhiz72k5imbigho5tjloesfuxw5y4rbapmbqimatvc7twska._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3f9d3c1d19fe95d4302831ddd9a56e248b4bdbb8e44207b03043013a8bf3b494

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 3f9d3c1d19fe95d4302831ddd9a56e248b4bdbb8e44207b03043013a8bf3b494

(this sample)

Formbook

Executable exe 6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9

  
Dropping
SHA256 6d923f02c2252e4a2ea98a8685fc5237354e2853791855f1a451a390dd85cbb9
  
Delivery method
Distributed via e-mail attachment

Comments