MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9725b56b6560fb7125010dbdb43bf2ccd4b7827cd87819205f0dbfb811981d1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9725b56b6560fb7125010dbdb43bf2ccd4b7827cd87819205f0dbfb811981d1e
SHA3-384 hash: 1973522560d9479c17e7f6041e495a0e3b1d8177a2ce2863d3cc07e1cbdff43bebb2b2e7134823b8f81e1d23716cdc33
SHA1 hash: ff53082cda72153a6ea2d77e290eac4b1ce8c1bd
MD5 hash: 2d86c7dc4c291f06c5e0b72d58276232
humanhash: twenty-charlie-alpha-three
File name:Paymentcopy.arj
Download: download sample
Signature Formbook
Create hunting rule
File size:705'537 bytes
First seen:2020-10-08 14:06:07 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:fZHO2T68UrTatctlb+ObX7pSa58R5b6KW2zAh6U8ygMH81qpqmLwH7kqvYq9:ftJ2nNvhX7pSM8R5b/WthCyvOmAkAX9
TLSH C1E423A016FF9D8BBA6F3C5E0036FC9C1167B608D417460BBDE49C4602A425B7753EE4
Reporter abuse_ch
Tags:arj FormBook


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server.miyoshi.biz
Sending IP: 111.235.136.178
From: Standard Chartered Bank <Account@transfopam.com>
Reply-To: sjrkintluea@gmail.com
Subject: Advice from Standard Chartered Bank
Attachment: Paymentcopy.arj (contains "Paymentcopy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9725b56b6560fb7125010dbdb43bf2ccd4b7827cd87819205f0dbfb811981d1e/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-08 13:10:02 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s4s3k23fmd5xcjibbw63io7sztklpat43b4bsic7bw73qemydupa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9725b56b6560fb7125010dbdb43bf2ccd4b7827cd87819205f0dbfb811981d1e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

arj 9725b56b6560fb7125010dbdb43bf2ccd4b7827cd87819205f0dbfb811981d1e

(this sample)

Formbook

Executable exe 3f8bef60842d6aa5827f315301d8b8b116a0938ed26f9da7eda3db51c104efb4

  
Dropping
MD5 55148fe655d805748c8acf4dbdf5a6da
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3f8bef60842d6aa5827f315301d8b8b116a0938ed26f9da7eda3db51c104efb4

Comments