MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f404ea538a7877697cbe16dafe4c22ecc8579da10306d653e551e86c87ed154. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f404ea538a7877697cbe16dafe4c22ecc8579da10306d653e551e86c87ed154
SHA3-384 hash: 82454286d320a468a9b6be63abf52e27de1fb20d93366941dbd3d7b5ae842fa081f3e913a0d64c84f9886c26acf30907
SHA1 hash: 538322ce832941fd46d1aa093f7568a763d7e33e
MD5 hash: 75b622806a18c77f75d92b4b7a77df4b
humanhash: harry-lemon-seven-saturn
File name:Mv Maersk Kleven V949E_pdf.xz
Download: download sample
Signature Formbook
Create hunting rule
File size:402'099 bytes
First seen:2020-12-03 08:31:16 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:xreZM8GnOKZhl737Id17sQwvM+VC9Vu2fUO+iaVY1arPAcHDhE+u2vlK63eUoI6e:YZDGOKh7YX8q02fULVq2q+o6uUEGgkH
TLSH 7084231247AE478C3B1AE4ACF581CC5D2A8237326D78C5F628E6C68D89C69DEDD83740
Reporter abuse_ch
Tags:FormBook Maersk xz


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: srv1.23soft.pt
Sending IP: 212.13.43.221
From: A.P. Moller - Maersk <nelsonbarros@nbmoveis.com>
Subject: RE : RE : URGENT!!! 2 x 20ft - SHIPPING DOC BL,SI,INV#462345 // MAERSK KLEVEN V.949E // CLGQOE191781 //
Attachment: Mv Maersk Kleven V949E_pdf.xz (contains "Mv Maersk Kleven V949E_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f404ea538a7877697cbe16dafe4c22ecc8579da10306d653e551e86c87ed154/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-03 06:44:42 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t5ae5jjyu6dxnf6l4fw27zgcf3gik6o2cayg2zj6kupinsd62fka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9f404ea538a7877697cbe16dafe4c22ecc8579da10306d653e551e86c87ed154

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

xz 9f404ea538a7877697cbe16dafe4c22ecc8579da10306d653e551e86c87ed154

(this sample)

Formbook

Executable exe bc7980d8d26972345c934f05a7f5f596b72957e06630c20a853b0c3146c5461c

  
Dropping
MD5 6916d4817690cb20ac0da10e560fd9c8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc7980d8d26972345c934f05a7f5f596b72957e06630c20a853b0c3146c5461c

Comments