MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 84b25de9894a4e582cc00392a73391d541698ea07b1ec8de819eef72fccdebea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 84b25de9894a4e582cc00392a73391d541698ea07b1ec8de819eef72fccdebea |
|---|---|
| SHA3-384 hash: | 16fb3f1e739c4d0e728795ca0d5d7126e23934d588ea0602c601ac1ce8b17fc795cd85d2c22d2c3fd3708e0ff5e905dd |
| SHA1 hash: | 42891cd8aa1a65397403628a0e0b1e85ea1a3fe7 |
| MD5 hash: | e7daf8d4d61f412b0c260e586188ea9f |
| humanhash: | grey-pasta-lake-potato |
| File name: | Request for Quotation 2026 090226.gz |
| Download: | download sample |
| File size: | 119'962 bytes |
| First seen: | 2026-09-24 19:49:15 UTC |
| Last seen: | Never |
| File type: | gz |
| MIME type: | application/gzip |
| ssdeep | 1536:2Pzx5HBxcb9sm89g78t4oAMUICvEm4FwfmrpR81VbCY39ekmgqSEAYywiRKtRD34:eDZg7jyUIw46uTS+Y39eOuyNC7+im |
| TLSH | T154C3122BFC8862A2C5B1883148FB61C84D95E0E3EEFB9F3D766A545761737B12C404D9 |
| Magika | gzip |
| Reporter |  netresec |
| Tags: | FormBook gz MonoGlyphRAT |
netresec
Received: from elsserv.com (mail.cdsdomains.net [74.208.12.112])by xxxx.xxxxxx.xx (Postfix) with ESMTPS id B9594917F0A
for <xxxxx@xxxxxxxx.xxx>; Thu, 24 Sep 2026 17:36:59 +0200 (CEST)
Received: from elsserv.com (unknown [216.180.124.100])
by mail.cdsdomains.net (Postfix) with ESMTPSA id 46FE93062C
for <xxxxx@xxxxxxxx.xxx>; Thu, 24 Sep 2026 08:35:38 -0700 (PDT)
From: Anna Marie Arciaga <adarciaga@elsserv.com>
To: xxxxx@xxxxxxxx.xxx
Subject: Request for Quotation 2026 090226
Date: 24 Sep 2026 16:35:37 +0100
Message-ID: <20260924163537.DF432CABCBCFB1AB@elsserv.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0012_BD9B03D8.2B9E4CF3"
X-PPP-Message-ID: <20260924153538.20514.46361@cdsdomains.net>
X-PPP-Vhost: elsserv.com
X-Rspamd-Queue-Id: B9594917F0A
X-Rspamd-Server: xxxx.xxxxxx.xx
X-Rspamd-Action: no action
X-Spamd-Result: default: False [0.35 / 15.00];
MIME_BAD_EXTENSION(1.00)[js];
NEURAL_HAM(-0.55)[-0.276];
MIME_HTML_ONLY(0.20)[];
R_SPF_ALLOW(-0.20)[+ip4:74.208.12.112:c];
MIME_GOOD(-0.10)[multipart/mixed];
RCVD_VIA_SMTP_AUTH(0.00)[];
ARC_NA(0.00)[];
RCVD_COUNT_ONE(0.00)[1];
RCPT_COUNT_ONE(0.00)[1];
MISSING_XM_UA(0.00)[];
MIME_TRACE(0.00)[0:+,1:~,2:-,2:~];
RCVD_TLS_ALL(0.00)[];
MID_RHS_MATCH_FROM(0.00)[];
DMARC_NA(0.00)[elsserv.com];
FROM_EQ_ENVFROM(0.00)[];
FROM_HAS_DN(0.00)[];
R_DKIM_NA(0.00)[];
TO_DN_NONE(0.00)[];
PREVIOUSLY_DELIVERED(0.00)[xxxxx@xxxxxxxx.xxx];
TO_MATCH_ENVRCPT_ALL(0.00)[];
HAS_ATTACHMENT(0.00)[]
Intelligence
File Origin
# of uploads :
1
# of downloads :
62
Origin country :
SEFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Request for Quotation 2026 090226.js |
|---|---|
| File size: | 282'812 bytes |
| SHA256 hash: | 5a5f48292a3afc22385eec07e1f143689bb4616f2d2014156ddd6fea06a837ec |
| MD5 hash: | ac6ad68e7fdb5cd1aa0a3aeeaa03bacb |
| MIME type: | text/plain |
Vendor Threat Intelligence
No detections
Detection(s):
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
anti-vm encrypted evasive fingerprint obfuscated repaired
Verdict:
Malicious
File Type:
gz
First seen:
2026-09-24T07:18:00Z UTC
Last seen:
2026-09-25T11:20:00Z UTC
Hits:
~100
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
GZip Archive
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2026-09-24 19:50:26 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
12 of 38 (31.58%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.78
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
gz 84b25de9894a4e582cc00392a73391d541698ea07b1ec8de819eef72fccdebea
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.C2: 45.141.148.134:2002 (TLS)
JA3: 72a589da586844d7f0818ce684948eea
JA4: t12i190700_d83cc789557e_7af1ed941c26
JA5: t12i190600_d83cc789557e_e8ab298402c8_30e06788707b
X.509 cert thumbprint: 24249b6b764deeef8cbb2c9f80ed7438c2d50f95
Subject + Issuer: CN = default