MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef65a30135b6992aaeacde426734212d73f563d0e6cffc59785aae1c495f8491. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef65a30135b6992aaeacde426734212d73f563d0e6cffc59785aae1c495f8491
SHA3-384 hash: 5bdc3646b189fe3ec8db3159cfa2b7678a081e4b5583caf7c9f1de3e83b2c76b46528ee75d5d5a0da7cc9dcc90c5ed51
SHA1 hash: 8727ca107ba2457f1e29f9fb050b93b0c5da8a86
MD5 hash: 41d6ffe41958a127f0d7a0bc93c76095
humanhash: blue-september-river-moon
File name:MANDUME - CTM REQUEST_pdf.exe
Download: download sample
File size:1'642'496 bytes
First seen:2020-05-18 10:34:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:dCdxte/80jYLT3U1jfsWat9GBYsY2d9a/zB1DL6Ub7pHdAZIl0Eo4PXm+xQ:0w80cTsjkWat9k+/91yUR92lEopZ
Threatray 5'330 similar samples on MalwareBazaar
TLSH 9775E02273DDC371CB769173BF69B7016EBB78614630B95B2F880D7CA910161262DBA3
Reporter jarumlus

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PWS.Stealer.19347.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 12:30:00 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
25 of 31 (80.65%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=55s2gajvw2msvlvm3zbgonbbfvz7ky6q43h7ywlylkxbysk7qsiq._file
Verdict:
malicious
Similar samples:
29247c960e16e376148704241453b7a008a62c050e9d11b2bba111452acb7fa3
4e0e1ee117544cc9cb6784d36db3d349624ef1c888267b1e266a03ddb17d33a1
6858f384401b1ef40dd4515a1604fdf9bb7e0d5caf85d8798c89604d830227e6
6e2a6ffd8aa7c33dca7aa63dd89a4b30b4bcb78d4a31db6d03d1f2434cf94e23
b8ee3458736fa73672b43a4c55e136bafc48b215dcb89dac28b5865ab59fc99c
bcc826091ec71230947aa1916263434935a58ffe5977cf415b1d970633939652
e3bdb2a06e43b09073cebd4f7a7fe633d45d1c6d149885f7b815cc591fe3b453
e69790e910b1817bcfb714f20fda02b6e024babd3dfcea8fa982192928a5df93
e6bdca558fb485e6ac7295d20f868902f2b790bc147fb3ab1e3a6628280d40f3
f91b7471cdeb5b3ff9ac0fbbef508f16a405631a3d3ec8014d0ad87d5e6fbcd5
+ 5'320 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-dg6h3593xn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.glamotd.com/gm1/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 62f4326ef0aaa04bb7121ed3081d674cbc2b6b69fc726c1460cbc5af8f3a582e

Executable exe ef65a30135b6992aaeacde426734212d73f563d0e6cffc59785aae1c495f8491

(this sample)

  
Dropped by
MD5 b0834d07facf31be640a5cb1552c7f0d
  
Dropped by
SHA256 62f4326ef0aaa04bb7121ed3081d674cbc2b6b69fc726c1460cbc5af8f3a582e
  
Delivery method
Distributed via e-mail attachment

Comments