MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b0b3790de86f2d7be49ce04c5abef6404211d8e65affbea3c200fdd64e3ca5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6b0b3790de86f2d7be49ce04c5abef6404211d8e65affbea3c200fdd64e3ca5e
SHA3-384 hash:	d4e1a5e86c28a9c07ede4f1f0b20dea043f84b127083082a7d28d8e8114678cd48b4947ab4644f7a3d715f584b5cd544
SHA1 hash:	f8817935876ffaa40623ca2d6455d0921710e26e
MD5 hash:	87009f4a7940b56f4ef64c09bdb2dece
humanhash:	robert-table-july-texas
File name:	facturas 000005111, 005112,, 005113, 005114,,, 00051153####.uue
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	638'768 bytes
First seen:	2024-03-01 18:48:06 UTC
Last seen:	Never
File type:	uue
MIME type:	application/x-rar
ssdeep	12288:XvhjCwE7JdrEFHZ2+hbhyFLWHPexb+9RFwbDxGjv/dQUVpg91ntqtqVfLv:/eehcFLePcywgD/dQUPgHtqtufLv
TLSH	T134D4231BCC61FA02BDDE4EC874E90216065FB896462A8E65F135C4C3D8CFF582B46D7A
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	V3n0mStrike
Tags:	FormBook uue

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

98

Origin country :

CL

Vendor Threat Intelligence

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

autoit fingerprint keylogger lolbin masquerade shell32

Link:

https://www.filescan.io/uploads/65e2231ff73edfc4770298ab/reports/d148efeb-9ea2-43a7-b966-686d4d57d3c3/overview

Hybrid Analysis Mal/DrodRar

Verdict:

Suspicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/6b0b3790de86f2d7be49ce04c5abef6404211d8e65affbea3c200fdd64e3ca5e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b0b3790de86f2d7be49ce04c5abef6404211d8e65affbea3c200fdd64e3ca5e/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-02-22 21:43:52 UTC

File Type:

Binary (Archive)

Extracted files:

26

AV detection:

18 of 38 (47.37%)

Threat level:

  5/5

Spamhaus Hash Blocklist Malicious file

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmftpeg6q3znppsjzycmlk7pmqccchmomwx7x2r4eah52zhdzjpa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6b0b3790de86f2d7be49ce04c5abef6404211d8e65affbea3c200fdd64e3ca5e