MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98b6bf5cca89526516d5f350d4797c7c918fcc98cdb552989e73c9414132f7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b98b6bf5cca89526516d5f350d4797c7c918fcc98cdb552989e73c9414132f7a
SHA3-384 hash: 5b3c996e03054c7078740627db6155ce9fa7d8e0d54923bd711d4c69a7f654703e91622a9fd9d2c805cec1953dc54eb0
SHA1 hash: 76b7854f59384c4d7215dd57b1fa52afe14428a0
MD5 hash: b360dba65fd6d4a96ba1527fb445a6ef
humanhash: lithium-four-south-mountain
File name:BL20551133(RO-KR)L1ZAR-S11pdf.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:655'120 bytes
First seen:2021-02-04 13:17:31 UTC
Last seen:2021-02-09 15:17:38 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:mr+Z+wg7mXr/MynBSr/D53NKOrC2zgzgqfcCz7QIkca9oWjDL:mr+swim7/MyBSr/F9KOlMXEcmdDL
TLSH C7D423D5609E9D462C033A4FD592A36CDFE4A85C3110A6A673F39F7DA8E35E50CF480A
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
7
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b98b6bf5cca89526516d5f350d4797c7c918fcc98cdb552989e73c9414132f7a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 05:31:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgfwx5omvcksmulnl42q2r4xy7err7gjrtnvkkmj446jifatf55a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b98b6bf5cca89526516d5f350d4797c7c918fcc98cdb552989e73c9414132f7a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b98b6bf5cca89526516d5f350d4797c7c918fcc98cdb552989e73c9414132f7a

(this sample)

Formbook

Executable exe bfeb54e5c139165386b0a468366c012d13562376cc4a82f3cd7d69723fee96a0

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bfeb54e5c139165386b0a468366c012d13562376cc4a82f3cd7d69723fee96a0
  
Dropping
MD5 ea42aa54e58b05c5340f892800af930b

Comments