MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb04046d55a4302e42803d41a23668db62048a117be879b95be48cbd774db231. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb04046d55a4302e42803d41a23668db62048a117be879b95be48cbd774db231
SHA3-384 hash: 3b1dac911b1496ddd5d13eadcca69e34e7b2d10e5a7b5924554bb35db58755d1fc3a2ff77dd48a857b9d668310f5586a
SHA1 hash: 7081340cce8be2573eb1cdcc417282b55cb7ce1c
MD5 hash: 91545dc99b737a5dd2c662e7e41f0da4
humanhash: lima-network-pennsylvania-earth
File name:Quotation(1).7z
Download: download sample
Signature Formbook
Create hunting rule
File size:670'692 bytes
First seen:2020-12-09 08:45:00 UTC
Last seen:2020-12-10 07:05:38 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:sZp7glTV0NI05Te5ABBWn+bht7KolPYvnm4zu58z3PrRDBFTry+D1i:sZp7gdcI05a2smt7Ko9w7ztBZhhi
TLSH 33E423F62ED47E028639F8EFBB17435AF4006C294335AA734F3525D2AF87A01759A613
Reporter cocaman
Tags:7z


Avatar
cocaman
Malicious email (T1566.001)
From: "AMY LIU<info@vicomfg.com>" (likely spoofed)
Received: "from vicomfg.com (unknown [45.35.101.8]) "
Date: "09 Dec 2020 03:41:29 -0500"
Subject: "RE: PO0119-16/20 Last Quarter Complied Quotations- Batch02320"
Attachment: "Quotation(1).7z"

Intelligence

File Origin
# of uploads :
3
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.th.32028.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb04046d55a4302e42803d41a23668db62048a117be879b95be48cbd774db231/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 08:45:06 UTC
File Type:
Binary (Archive)
Extracted files:
39
AV detection:
10 of 48 (20.83%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb04046d55a4302e42803d41a23668db62048a117be879b95be48cbd774db231

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

7z fb04046d55a4302e42803d41a23668db62048a117be879b95be48cbd774db231

(this sample)

Formbook

Executable exe b7000ac571c057d5eeed8c6cc904674b067ddd0a5a9cd6843669efe0667baa17

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b7000ac571c057d5eeed8c6cc904674b067ddd0a5a9cd6843669efe0667baa17

Comments