MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0844afb76322a84d5686a85625f70c99ed54b12c7f35ac0e426baec4376fc989. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0844afb76322a84d5686a85625f70c99ed54b12c7f35ac0e426baec4376fc989
SHA3-384 hash: e9d7af2d2759efedbfa1b728b8ce15e286a1aa1ca1d5f6f315ba4b3affed0dca6debd63038d394af0c36e849fa96919d
SHA1 hash: 0f3c42c81bb23d65c6aaf62235c2651969e67ce9
MD5 hash: e3194be343f1ffb75ccdbd279d8a3ae2
humanhash: virginia-jersey-social-hawaii
File name:Zahlungskopie f�r Buchungen meiner Frau.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:848'970 bytes
First seen:2022-09-30 14:38:13 UTC
Last seen:2022-09-30 14:47:15 UTC
File type: rar
MIME type:application/x-rar
ssdeep 24576:W/19Nj2dbBoilcb1uFYkZEmNpzsTPyKoCq41V:8VCdtoUc1uFYkBATPyFCqu
TLSH T1D505334F22412843FEB2E43526F49F1165BDAB78FACC0CF41E97B9582CA6684D701E76
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "=?UTF-8?B?SGVpbnogTMO8c2NoZXI=?= <pratya@yayaasiatravel.com>" (likely spoofed)
Received: "from yayaasiatravel.com (unknown [141.98.10.87]) "
Date: "27 Sep 2022 19:01:28 +0200"
Subject: "=?UTF-8?B?UmVzZXJ2aWVydW5nIGbDvHIgbWVpbmUgRnJhdSAvIFByZW5vdGF6aW9uZSBwZXIgbWlhIG1vZ2xpZQ==?="
Attachment: "Zahlungskopie f�r Buchungen meiner Frau.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0844afb76322a84d5686a85625f70c99ed54b12c7f35ac0e426baec4376fc989/
Threat name:
Win32.Spyware.SnakeLogger
Create hunting rule
Status:
Malicious
First seen:
2022-09-27 15:49:13 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
21 of 40 (52.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bbck7n3dekue2vugvblcl5ymthwvjmjmp422ydscnoxmin3pzgeq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:rsea rat spyware stealer trojan
Link:
https://tria.ge/reports/220930-rz96msdha4/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0844afb76322a84d5686a85625f70c99ed54b12c7f35ac0e426baec4376fc989

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 0844afb76322a84d5686a85625f70c99ed54b12c7f35ac0e426baec4376fc989

(this sample)

Formbook

Executable exe f65fc925a48a5dd04ef9265fe5bcf73a5e903352454fe23a8f04b2304a050235

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f65fc925a48a5dd04ef9265fe5bcf73a5e903352454fe23a8f04b2304a050235
  
Dropping
Formbook
  
Dropping
MD5 dd5e073ffac4a782f687e2d5c5f498eb

Comments