MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd326a152143c9908589386888b653fdf0667b08ab9328eaeb95673c2dc93615. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd326a152143c9908589386888b653fdf0667b08ab9328eaeb95673c2dc93615
SHA3-384 hash: 23b12eaa880521929428e0196d0353498655166f851330e3302ea797c96b1877b1701eedd361be8e82f1d37de336d6c9
SHA1 hash: 7e74b29279a2a11674b3c40f4e1c9d624dbf7c3a
MD5 hash: 3698eda476691fc25ca783e4d02a2da8
humanhash: robin-social-carbon-twelve
File name:Arrival Notice.r00
Download: download sample
Signature Formbook
Create hunting rule
File size:424'100 bytes
First seen:2022-06-13 06:22:55 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:YRbeHPk39DkPjD3cJuXWUlqNtio4645XZ/Tf5:MbevQS8JuFysJ645RTf5
TLSH T1E0942357F2B8F36921F75F91832CBB2E6B726F26299F0590702190F613D0646ED2624F
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook r00


Avatar
cocaman
Malicious email (T1566.001)
From: "csdept@coreana.com.hk" (likely spoofed)
Received: "from coreana.com.hk (unknown [185.222.58.59]) "
Date: "13 Jun 2022 06:52:13 +0200"
Subject: "FW: Pre Cargo Arrival Notice"
Attachment: "Arrival Notice.r00"

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd326a152143c9908589386888b653fdf0667b08ab9328eaeb95673c2dc93615/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-06-13 01:34:14 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zuzgufjbipezbbmjhbuirnst7xygm6yivojsr2xlsvttylojgykq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cd326a152143c9908589386888b653fdf0667b08ab9328eaeb95673c2dc93615

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

r00 cd326a152143c9908589386888b653fdf0667b08ab9328eaeb95673c2dc93615

(this sample)

Formbook

Executable exe c86c4b2413ae0161438065f00f28eae576d2fdfb2a27d06752316f1d1860edb1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c86c4b2413ae0161438065f00f28eae576d2fdfb2a27d06752316f1d1860edb1
  
Dropping
Formbook
  
Dropping
MD5 7d71400ae523be4c870fca01cad243ae

Comments