MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d796f6805d3b2379a57954f070415cabded6cf360544f1ba36acb75d558449db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | d796f6805d3b2379a57954f070415cabded6cf360544f1ba36acb75d558449db |
|---|---|
| SHA3-384 hash: | ea26f563641b69952913e338b48f93f1f1619bfaf54698f37f22f229fe654b70105093b24c6d383cfd6c2a9ca41f41df |
| SHA1 hash: | 8d8c3ef4a581b28c93ebffd2dd6f8c06f1f42446 |
| MD5 hash: | 7df9a7f352c018c778c850727074fb09 |
| humanhash: | asparagus-sad-xray-diet |
| File name: | HS361 dt 22.10.20.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 465'920 bytes |
| First seen: | 2020-10-22 07:41:42 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 6144:m5LGM4cDvQ/ts9gCGBo2XN1gXCZjtZSSpTuMQgvqutGOKqdjWscDYnpUl4SPemuq:mwM4WQ/c2V3yMQgvquQOhBWseYSl40 |
| Threatray | 4'683 similar samples on MalwareBazaar |
| TLSH | 6BA4BFB27C92587ECA6E0771416984C1FABA16C73FA48B0D725F830C0E15A2BFB57257 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing unidentified malware:From: G Joseph <support@qbasica.com>
Subject: FW: Freight Invoice - TRUE LOGISTICS [P] LTD
Attachment: HS361 dt 22.10.20.zip (contains "HS361 dt 22.10.20.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Formbook
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a file
Running batch commands
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-10-22 02:54:16 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
formbook
Similar samples:
+ 4'673 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Unpacked files
SH256 hash:
d796f6805d3b2379a57954f070415cabded6cf360544f1ba36acb75d558449db
MD5 hash:
7df9a7f352c018c778c850727074fb09
SHA1 hash:
8d8c3ef4a581b28c93ebffd2dd6f8c06f1f42446
SH256 hash:
d251f33c578b44146aee824a95ff1e1f9a725c8d3e5d03924ce4227338c0c6fb
MD5 hash:
b47e8eafd28086d8b02d9a37787139b6
SHA1 hash:
2b120487d7f2f693d542fbda126491c0a3092ebd
SH256 hash:
19d9922060be89a70b76e5c0056e751f1baa5d41819235c92cf4f5d7668e1267
MD5 hash:
811864a0b06c529af894a7fec6ddbf47
SHA1 hash:
d35b82933eb06a6ec60e8cbbdb65eb6cdcaeb6d2
SH256 hash:
d97f88b1ee3cad60391e782a50d29bcdc1d1e45982596b96ca551123feaf493e
MD5 hash:
23f3b8ec6e1bae5ab3c38698ddb69cc7
SHA1 hash:
8ac62a203cf5abdaf5726a0979144a5aa7fd7010
SH256 hash:
b55df4ebfc5541dd6563c67c7bd86cde5569404ccfcc27bc084eacf6981fd442
MD5 hash:
bff16fcabf604a4a0136274f2165ad93
SHA1 hash:
bf3f86133fd623c6d8082bab202ec99b5dcbf9d4
Detections:
win_formbook_g0
win_formbook_auto
SH256 hash:
66dc74443453711b2e742951e77b0c6693de7e9489c67a463f6f2b21158760d1
MD5 hash:
66bd32648f1fd0d7ef701b259a8edeb6
SHA1 hash:
60b94f1d82922b5f6cfe6e0542707a1972241b9f
SH256 hash:
4eba9a7b577dadbc6ef5cf7eb9c923ead9bf6e92d4561b979926e89f7171eb38
MD5 hash:
61c8bc304dd1bd94883f4a6477ecbabb
SHA1 hash:
d558cef1137bc26cc396d9170803d79cf41b1525
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.