MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb11628d7ef679c5ba0e20f1e8a2c39ea608b9798f65c96bcdc4e74d011821b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb11628d7ef679c5ba0e20f1e8a2c39ea608b9798f65c96bcdc4e74d011821b0
SHA3-384 hash: 0171f0eb900102ac04923779d124a8224279d8a4d401a7a54056213b609e3726426fbb677a9eed5a57d702c38a14a25d
SHA1 hash: f30004b1229c9bdd10ebd032c2f7f5a3f67a0fe5
MD5 hash: 88a2ee1bbebca67c3e4c494b4bee91e7
humanhash: alabama-king-chicken-comet
File name:Proforma invoice.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:730'014 bytes
First seen:2020-12-07 06:32:47 UTC
Last seen:2020-12-07 06:34:15 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:YELfDBzb0Brs+GyTqBqdiRqi60xF+3p7atWYn75EVknJtuVXNoW:D+BrsgqPmoipgvn75EVsvufoW
TLSH 6DF423FDECCAB42DBAC1357241A9DBE257C1A5BA75018074BFAED908B64F413D5E80B0
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Accounts<moonis@transpro-logistics.com>" (likely spoofed)
Received: "from transpro-logistics.com (unknown [103.99.1.159]) "
Date: "06 Dec 2020 20:00:55 -0800"
Subject: "RE: Revise PI"
Attachment: "Proforma invoice.rar"

Intelligence

File Origin
# of uploads :
3
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb11628d7ef679c5ba0e20f1e8a2c39ea608b9798f65c96bcdc4e74d011821b0/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-07 02:49:41 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmiwfdl66z44loqoedy6riwdt2tarolzr5s4s26nyttu2aiyegya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cb11628d7ef679c5ba0e20f1e8a2c39ea608b9798f65c96bcdc4e74d011821b0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar cb11628d7ef679c5ba0e20f1e8a2c39ea608b9798f65c96bcdc4e74d011821b0

(this sample)

Formbook

Executable exe c69e882c771b1818558a97832a4ffc97db0ca2bdca969abcae1b1b9094123b0b

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c69e882c771b1818558a97832a4ffc97db0ca2bdca969abcae1b1b9094123b0b

Comments