MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f469d7a84ba48d8c9a9ae5bfbfa38b708a74d330a2507a7a527d8eb32c0c40af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f469d7a84ba48d8c9a9ae5bfbfa38b708a74d330a2507a7a527d8eb32c0c40af
SHA3-384 hash: e92d4131b3fc4754d26c4f1099b7e5610ab01a360b6da216cdb50bbf9ff364ac29cb0baaa5fa7fac189bb1697abaaa42
SHA1 hash: ff63c7edd5b2aa0ea81d1bb0b2cea74e720503f3
MD5 hash: e91417159c9fafcc9d9d9e8229403929
humanhash: aspen-rugby-violet-texas
File name:scan_098.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:683'418 bytes
First seen:2020-12-15 06:19:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:wkhNe7t30de5T6vIN384YN0jHfpUFH6ZBF1slfbAtZtH0d:fh8JeAMINM4YNaxiHgF6pq0d
TLSH 58E433885C01E74D0688F93768AF45AD14450A7FB2224FBDB2EAB771BC497A350EFB05
Reporter cocaman
Tags:rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Jessica <jessica@vortexfield.eu>" (likely spoofed)
Received: "from vortexfield.eu (unknown [37.120.206.112]) "
Date: "14 Dec 2020 11:42:16 -0800"
Subject: "Payment Sent T/T Receipt Attached."
Attachment: "scan_098.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f469d7a84ba48d8c9a9ae5bfbfa38b708a74d330a2507a7a527d8eb32c0c40af/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-15 06:20:07 UTC
File Type:
Binary (Archive)
Extracted files:
32
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ru5pkclusgyzgu24w737i4locfhjuzqujihu6sspwhlglamicxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/f469d7a84ba48d8c9a9ae5bfbfa38b708a74d330a2507a7a527d8eb32c0c40af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar f469d7a84ba48d8c9a9ae5bfbfa38b708a74d330a2507a7a527d8eb32c0c40af

(this sample)

Formbook

Executable exe 7a27d2398eb1658d1e8ab0fb1c67c154e74712079e7adda5f0af704780c9c741

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7a27d2398eb1658d1e8ab0fb1c67c154e74712079e7adda5f0af704780c9c741

Comments