MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03
SHA3-384 hash: 2de24b477ee2978b84b8f6200ac753fc40595e1df6993767a70e1759c43b73b5219d3a8fe75b8f9ce8133233f668ed8c
SHA1 hash: 878ac4f98589f648c466a3096ea0fc43c10f36ac
MD5 hash: 8044eda768f2e36fe07cbadb249fd8dc
humanhash: stairway-mockingbird-orange-king
File name:Soa & Invoice.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:554'346 bytes
First seen:2021-07-19 05:54:07 UTC
Last seen:2021-07-19 05:55:16 UTC
File type: r00
MIME type:application/x-rar
ssdeep 12288:s/Qtv+IiUWV7YR1otnjVojiK5D+CywSWXtYn2eRcJBsqnD3WQCCuUM7:sv5VszotnZ8iK5lSWX+0BsqDmSG
TLSH T17AC4334C1EDD4693A7B0B128B3B2677E29A0C8FC71B32B518B975D9F7CE549AD14220C
Reporter cocaman
Tags:FormBook INVOICE r00


Avatar
cocaman
Malicious email (T1566.001)
From: "info@asquareexhibition.com" (likely spoofed)
Received: "from asquareexhibition.com (unknown [45.137.22.139]) "
Date: "19 Jul 2021 06:23:08 +0200"
Subject: "FW: Outstanding Payments Invoices/ Statement Of Account,"
Attachment: "Soa & Invoice.r00"

Intelligence

File Origin
# of uploads :
2
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-07-19 01:55:22 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
4 of 45 (8.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rhm5wvelp2nwejhwwbvzzanmfarxo6nf7wewgowi77vncynaxqbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 89d9db548b7e9b6224f6b06b9c81ac28237779a5fd89633ac8ffead161a0bc03

(this sample)

Formbook

Executable exe 2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e

Comments