MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 049674fef8d2f0a5c42b8372d3ebf8a1dc5986a0a4376890882b32e3dbf58ead. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 049674fef8d2f0a5c42b8372d3ebf8a1dc5986a0a4376890882b32e3dbf58ead
SHA3-384 hash: e071c5c5d55316a17a5d142e263ab65617bdf7c8efefd71fb469ad255c341e7d6a81e6aa9e9c109da42c12befdbc672e
SHA1 hash: 51e3f789d2595c1ab68b5a0d83835e82543ab9a5
MD5 hash: 2dd3723b9fabd34ceb136238aef1ae61
humanhash: island-magazine-six-magazine
File name:Purchase Order.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:228'386 bytes
First seen:2021-06-05 07:30:49 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:gW76u6Eea/sUEaH8GyWzFmFnA4xQcX//QKxoaAdGMoO:gW7n6EeDFuJ9UFAyQ2/YKqaAdB
TLSH 152423FF04586D6E905D5C64AEAA3008B9374AFCD392F6C37731DB84C3986A4C95BE21
Reporter cocaman
Tags:lzh rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Abdelmajid IJRHA<spreadsheets@forbes.com>" (likely spoofed)
Received: "from forbes.com (unknown [45.137.22.37]) "
Date: "4 Jun 2021 18:44:36 -0700"
Subject: "Purchase Order 0060/2021"
Attachment: "Purchase Order.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
664
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27213.RarHeur.nocdb.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/049674fef8d2f0a5c42b8372d3ebf8a1dc5986a0a4376890882b32e3dbf58ead/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2021-06-05 07:31:12 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 46 (34.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aslhj7xy2lyklrblqnznh27yuhoftbvauq3wreeifmzohw7vr2wq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/210605-d29h59skgn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.moneyhuntercom.info/ngvm/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/049674fef8d2f0a5c42b8372d3ebf8a1dc5986a0a4376890882b32e3dbf58ead

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 049674fef8d2f0a5c42b8372d3ebf8a1dc5986a0a4376890882b32e3dbf58ead

(this sample)

Formbook

Executable exe c9d50247773b2782dc68bf540873be97f2dc7aa8034d6375822f21ff5c470d67

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c9d50247773b2782dc68bf540873be97f2dc7aa8034d6375822f21ff5c470d67

Comments