MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0f8acbcde0c3f0f60b101a72f778b7d29a9a799f607e4ec00aa28dc734d0fbfa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 4
| SHA256 hash: | 0f8acbcde0c3f0f60b101a72f778b7d29a9a799f607e4ec00aa28dc734d0fbfa |
|---|---|
| SHA3-384 hash: | 669cbbceefd3d59566d88cc7b2f3249846d9322bc7bc2210f2903d6ae64eda530ce2082e6bca572d0dad66a4ccde5b0d |
| SHA1 hash: | a0e70f513fd1250c3d590b993a536e8b12734bd1 |
| MD5 hash: | e9eabf4787fffcba5342a1e9c08e3f5e |
| humanhash: | oranges-network-lamp-april |
| File name: | Invoice 5.exe |
| Download: | download sample |
| Signature | Formbook |
| File size: | 343'040 bytes |
| First seen: | 2020-05-27 07:58:15 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5fd94ccd1dec1c5baf6be7519f2d9282 (8 x Formbook) |
| ssdeep | 6144:EkJSjYIwK0ORK/z9o021oARCIyOFBOcXQYyoyAiZXDzdkD:3JYt3qo021lyqBOcXtybzzdkD |
| Threatray | 5'311 similar samples on MalwareBazaar |
| TLSH | 2974BE22AA3C523CC53F50767DDB9DA68DD644E3206F5D96EA9CE002C92C7C10AA7377 |
| Reporter |  abuse_ch |
| Tags: | exe FormBook |
abuse_ch
Malspam distributing Formbook:HELO: slot0.inonioge.com
Sending IP: 45.95.169.128
From: Sally Yao (PUR) <sally@moonpo.com>
Subject: Purchase Order P.O.T201713--1S349D---( 2020/04/15 MRP)
Attachment: Invoice 5.exe
Intelligence
File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Zusy
Status:
Malicious
First seen:
2020-05-27 01:56:02 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
20 of 30 (66.67%)
Threat level:
2/5
Verdict:
malicious
Label(s):
emotet
trickbot
Similar samples:
+ 5'301 additional samples on MalwareBazaar
Result
Malware family:
formbook
Score:
10/10
Tags:
family:formbook rat spyware stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.porcber.com/dty/
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.