MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 310148ae5e69b2ccfd91c5e3af16d0bfbe3c6aba0d348b5512a4932af2afaf17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 310148ae5e69b2ccfd91c5e3af16d0bfbe3c6aba0d348b5512a4932af2afaf17
SHA3-384 hash: ecd7963948d63c9c7228894db55ba3c56bac4b23f0bcf8a0bd36d7e230ccf85cabec36511608840b5ff11fc473d435c7
SHA1 hash: 3cf945c129557f195a65ca85f43502052caf4c1c
MD5 hash: cef93ba770cfbdae2f883e71a5b8ef7a
humanhash: november-nineteen-quebec-vegan
File name:PI L032452021xxls.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:571'948 bytes
First seen:2021-09-15 07:27:24 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:cljvs1NAYxstukm4O/N5g2YvKPEyUx6OKDP9Nmu3dN8eZdffc:cOQYxstukm4O/rg2fTJP6utI
TLSH T158C4234638F5EAC3B472D0E2609C319E72D87638C60A56943C59FEF92DDF49A608DD0B
Reporter cocaman
Tags:FormBook lzh rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Rui Pereira <rpereira@rizalnor.com>" (likely spoofed)
Received: "from rizalnor.com (unknown [45.137.22.48]) "
Date: "15 Sep 2021 08:58:04 +0200"
Subject: "=?UTF-8?B?UmU65Zue5aSNOiBQTzEyNjEyNiwgUE8xMjYxMjcsIFBPIDEyNjEyOA==?="
Attachment: "PI L032452021xxls.lzh"

Intelligence

File Origin
# of uploads :
1
# of downloads :
248
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/617516099a5a1e91c5d2028f/reports/b31ce826-fff8-4331-8ded-10b7a236bd1b/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/310148ae5e69b2ccfd91c5e3af16d0bfbe3c6aba0d348b5512a4932af2afaf17/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2021-09-15 07:28:17 UTC
File Type:
Binary (Archive)
Extracted files:
31
AV detection:
7 of 42 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=geaurls6ngzmz7mryxr26fwqx67dy2v2bu2iwvisusjsv4vpv4lq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ergs rat spyware stealer trojan
Link:
https://tria.ge/reports/210915-jan8waaah6/
Behaviour
Gathers network information
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.barry-associates.com/ergs/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/310148ae5e69b2ccfd91c5e3af16d0bfbe3c6aba0d348b5512a4932af2afaf17

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 310148ae5e69b2ccfd91c5e3af16d0bfbe3c6aba0d348b5512a4932af2afaf17

(this sample)

Formbook

Executable exe 69394a249833f97289151fa8334f32e0b0467ce4ecb164b0706784fb836136a6

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 69394a249833f97289151fa8334f32e0b0467ce4ecb164b0706784fb836136a6
  
Dropping
Formbook

Comments