MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7884b936b4725d4548cf9d40c262d9098eaf19cdac9ca7f2457838441ea7aaff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7884b936b4725d4548cf9d40c262d9098eaf19cdac9ca7f2457838441ea7aaff
SHA3-384 hash: a1f9972487183b5f51d6ead18369e50b58806155e17700d03fa3a16b564fc8c51cdbb0d0d3cc3bd120ece9ed440a3b70
SHA1 hash: 8a8fbd6af8c0f22638fb2d7c521408cd4bed3b23
MD5 hash: 817c69d9614f5402c3580a3665b30b3d
humanhash: pasta-colorado-mockingbird-pasta
File name:Purchase Order (2).arj
Download: download sample
Signature Formbook
Create hunting rule
File size:375'252 bytes
First seen:2020-07-21 06:23:14 UTC
Last seen:2020-07-21 07:11:54 UTC
File type: arj
MIME type:application/x-rar
ssdeep 6144:1KwNB7Qlyo1odnCy/rlhqJwX427FeFh1B1WEhqKYjQnqUxn6UNo7KM8fbv1NEhxA:1ZNFQtudnCsiJA4Ie7PZqKYjXwVu7w5B
TLSH 1D842353B5F700ADB189AE6507F8481C695EC854439E821F883F187DEAB3A8FCC2D658
Reporter cocaman
Tags:arj FormBook


Avatar
cocaman
Malicious email
From: "depertmentpurchase@gmail.com "<doors@specialtysupplies.com>
Received: from www.specialtysupplies.com (www.specialtysupplies.com [199.192.145.28])
Date: Mon, 20 Jul 2020 23:53:03 -0700
Subject: Purchase Order
Attachment: Purchase Order (2).arj

Intelligence

File Origin
# of uploads :
5
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7884b936b4725d4548cf9d40c262d9098eaf19cdac9ca7f2457838441ea7aaff/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 06:25:06 UTC
File Type:
Binary (Archive)
Extracted files:
10
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pcclsnvuojouksgptvameywzbghk6gonvsokp4sfpa4eihvhvl7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7884b936b4725d4548cf9d40c262d9098eaf19cdac9ca7f2457838441ea7aaff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 7884b936b4725d4548cf9d40c262d9098eaf19cdac9ca7f2457838441ea7aaff

(this sample)

Formbook

Executable exe 0725fa234dd7f9bdcbcd0eef96c79017200f5c27676e4126a00c6d33e6601a5a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0725fa234dd7f9bdcbcd0eef96c79017200f5c27676e4126a00c6d33e6601a5a
  
Dropping
Formbook

Comments