MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0899d3894338f52e9c7108e34d49e9b99fd9f6d78536cacedca6c1c90a9fdf58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	0899d3894338f52e9c7108e34d49e9b99fd9f6d78536cacedca6c1c90a9fdf58
SHA3-384 hash:	4b4b877c414862f4c68de300bdaae01a1d39ed203ca49080b1c22e7ad0bac0d30e606fd6ae93b92d3de4ba45ac050702
SHA1 hash:	16fb37f13741698a76143bd2838124dc593ff4b4
MD5 hash:	e65378a4104452cb027d9898c95c57bd
humanhash:	johnny-gee-spaghetti-hydrogen
File name:	Transfer of rights and privilege.r15
Download:	download sample
Signature	Formbook Create hunting rule
File size:	597'369 bytes
First seen:	2024-11-15 07:11:56 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:6yRapBYCt5V6QbqCiYls/bE8/pJrmHydYqc1AjCp7tVv:Hc4YBb8Y4bT/j6Hyax1uCxv
TLSH	T17CD42391FF1A4CBEC5411D6F6EAEF43CBCDD1EADB9888690AA8E59145C407C20B5E360
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook r15 rar

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Transfer of rights and privilege.exe
File size:	1'105'920 bytes
SHA256 hash:	e5eda013173004830010766af13273e9ee2b96c0c63628a531945e4e8c0da884
MD5 hash:	fa91a7463a9ea4918102bccaa035dac1
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67354fd234b6906b3482a0d0

Tags:

phishing autoit emotet

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0899d3894338f52e9c7108e34d49e9b99fd9f6d78536cacedca6c1c90a9fdf58

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0899d3894338f52e9c7108e34d49e9b99fd9f6d78536cacedca6c1c90a9fdf58/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-13 23:59:15 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bcm5hckdhd2s5hdrbdru2spjxgp5t5wxqu3mvtw4u3a4scu735ma._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:cl21 discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/241115-jrjdys1dph/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Checking for malicious import combination that common Ransomware mostly use