MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80e6305ec55a3249c1d90a7f6cbbe0411167a00c39bd655b8cfe70baa37fee64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80e6305ec55a3249c1d90a7f6cbbe0411167a00c39bd655b8cfe70baa37fee64
SHA3-384 hash: c8ab300c6e9201c28207b1c7e421d8cf34ab3f585901066d70bb76b6a13c24cee660bbe82cca4b4d9dfdb34357a53150
SHA1 hash: fb2103adc442bcee82df90d327acd5b126624027
MD5 hash: 29674503187272d71bd1dcfa85e3438c
humanhash: vermont-bulldog-hydrogen-video
File name:ORDER7946ERA-LBT.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:526'006 bytes
First seen:2021-04-08 07:02:28 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:JSZmgrtKpL3+cD7bsni0je3qEJ8TPljazpuW9vHp3IO23zis:sZm4tKxZbgix3qmW4gCvdIVj9
TLSH 9DB423BD81F72B0AC5A8F837E26BCAEF6EC4440990DD6D58045C1AA2F1AC77D7D1C428
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: hbtovs.com
Sending IP: 111.90.139.164
From: Gloria Chan <Gloriachan@hbtovs.com>
Subject: Attached selected items and confirmed copy of Order and Sales Contract Draft for your reference.
Attachment: ORDER7946ERA-LBT.rar (contains "ORDER7946ERA-LBT.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80e6305ec55a3249c1d90a7f6cbbe0411167a00c39bd655b8cfe70baa37fee64/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 07:03:17 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdtdaxwflizetqozbj7wzo7aieiwpiamhg6wkw4m7zylvi375zsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/80e6305ec55a3249c1d90a7f6cbbe0411167a00c39bd655b8cfe70baa37fee64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 80e6305ec55a3249c1d90a7f6cbbe0411167a00c39bd655b8cfe70baa37fee64

(this sample)

Formbook

Executable exe 9f578e7bf0375c366223406cd1504c79feb2f2408f88ffbccc22cd1bc3237389

  
Dropping
MD5 b36e69f884b74fe568bdb7fdb06362cb
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f578e7bf0375c366223406cd1504c79feb2f2408f88ffbccc22cd1bc3237389

Comments