MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2fcab21d4d5863ef934dd19e96379fb5e796b9ae4d77d1d6784bfc25887ffacb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2fcab21d4d5863ef934dd19e96379fb5e796b9ae4d77d1d6784bfc25887ffacb
SHA3-384 hash: 1358d1dca50f1efe8f755df4d9d50f0b3384873a58186b0fedbf0b882beafb81b3a10d46dfa9a5b3f144bbe38a2ed382
SHA1 hash: 34cd5e91428e6060a760037741258a8ec8e10921
MD5 hash: c0d376a5461e08532976193aebacaf6a
humanhash: stairway-bravo-hawaii-connecticut
File name:2fcab21d4d5863ef934dd19e96379fb5e796b9ae4d77d1d6784bfc25887ffacb
Download: download sample
Signature Formbook
Create hunting rule
File size:615'264 bytes
First seen:2020-03-27 08:05:22 UTC
Last seen:Never
File type:Rich Text Format (RTF) rtf
MIME type:text/rtf
ssdeep 12288:G/QaPFpqGI8St7vOUzoWjyC7ZOskNSDKk+EL20w/nWGc4NVT9:WLUGI8yDOUk1mO9TB08e4Z
Threatray 4'846 similar samples on MalwareBazaar
TLSH CFD47EB4E1341891E22B4116A9597B94026EFD1EB9C6F8B4F0E7E5B1CD5FEF3AE01804
Reporter Marco_Ramilli
Tags:FormBook rtf

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Dropper.Gandcrab-7077551-0
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

MiscreantPunch.EXEInsideOfRTF.2.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27489.RtfHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27388.RtfHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Exploit-RTF-Dropper-1.UNOFFICIAL
Create hunting rule

Rtf.Exploit.CVE_2018_0802-6825822-0
Create hunting rule

MiscreantPunch.EXEInsideOfRTF.1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.RTFSTR.SCRIPTLET.200421.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-RTF.Trojan.CVE-2017-8570
Create hunting rule
Status:
Malicious
First seen:
2018-07-02 06:20:49 UTC
File Type:
Document
Extracted files:
27
AV detection:
33 of 43 (76.74%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
00983a8176276beea115d21fef7919c49b29b96d78dbc2151cc04cc7d8c95b35
Formbook
0cd1ca47d2e04de65562e1ba4d8ce4545ee486999f8f0eb7adc880c7fb7fc9b8
Formbook
1a96662a743a681756e4ae5ed7a3d259cca5a50725413698c1769939a950b455
Formbook
2ad145ebeae4ff20eeb893b16658fe43d7557f30c746edc355a5dceb393bf8bb
Formbook
923a8eab7773b5be5e3e380de1505a2c6c71f7b82329e9f3b3ff1461dc057610
Formbook
d7083f1007834bbc16f0b6d2ee0e1e2b9e79a04af2a2e21f2d2682c9dff939eb
Formbook
e65997e20f521c8eee713623c45c9600a7a05629c85d73c9dd2bdf696f43e5de
Formbook
eca4673c4308cb6dfd3757fcda824d93b7076fa2b2e7b2912863cdc4cb3f422e
Formbook
ef65a30135b6992aaeacde426734212d73f563d0e6cffc59785aae1c495f8491
Formbook
f91b7471cdeb5b3ff9ac0fbbef508f16a405631a3d3ec8014d0ad87d5e6fbcd5
Formbook
+ 4'836 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments