MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3354e76881fabfeb201fc956e0e8f7c7a522f4e12ce971f290b58084c6dd04ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Formbook
Vendor detections: 7
| SHA256 hash: | 3354e76881fabfeb201fc956e0e8f7c7a522f4e12ce971f290b58084c6dd04ea |
|---|---|
| SHA3-384 hash: | 14e7ffb7a7fea1c4e90cec8665c1cebe1a5806f77f155f3922e50d9fba9b620bb9f3be7900c7578108082a0859cd7506 |
| SHA1 hash: | 64f5376a71049b3ccdfc443ec0dce940ae7c1ca3 |
| MD5 hash: | 71df25bd6cec3166ff50297d9be01732 |
| humanhash: | sink-neptune-steak-steak |
| File name: | payment _documents.iso |
| Download: | download sample |
| Signature | Formbook |
| File size: | 1'245'184 bytes |
| First seen: | 2022-05-19 06:10:49 UTC |
| Last seen: | Never |
| File type: | iso |
| MIME type: | application/x-iso9660-image |
| ssdeep | 6144:GOtIp6+bKahZgieehSZ0Kyc4znm3Eh6JWMHxvZj2:GOcr2aQ2SHyzznmUh6IMFZ |
| TLSH | T11C45F151E7E2D8D3FA630D350B719EA50DE892026533867B37FDEA067F572C0992A342 |
| TrID | 99.4% (.NULL) null bytes (2048000/1) 0.2% (.ISO) ISO 9660 CD image (5100/59/2) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) |
| Reporter |  cocaman |
| Tags: | FormBook iso payment |
cocaman
Malicious email (T1566.001)From: "Sarah Marchisio<sarah@cobra-cs.com>" (likely spoofed)
Received: "from cobra-cs.com (unknown [103.167.92.238]) "
Date: "18 May 2022 17:45:05 -0700"
Subject: "Bank_order-form"
Attachment: "payment _documents.iso"
Intelligence
File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe lokibot overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Threat name:
Win32.Trojan.LokiBot
Status:
Malicious
First seen:
2022-05-18 23:51:26 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 26 (65.38%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
xloader
Score:
10/10
Tags:
family:formbook family:xloader campaign:few9 loader rat spyware stealer suricata trojan
Behaviour
Gathers network information
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Xloader Payload
Formbook
Xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.