MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd
SHA3-384 hash:	c587177209c4f445a4a9741ebbcc4a63704d0f2384ff641b39f1da69c7c32f4244f40241883a851f3d9b09fb55a12217
SHA1 hash:	1796d4903968d900e8bb96ac5cc7bd159be275c3
MD5 hash:	d2dec1e1e45f3657e81e308976cb72fa
humanhash:	lamp-bulldog-berlin-rugby
File name:	AWB728590890733.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	638'538 bytes
First seen:	2023-06-06 12:37:42 UTC
Last seen:	2023-06-06 12:40:04 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:sAGFDFclM/aqn1SIOoeAuUQIM2ilGm+gGEoEPCQORVkTVEX:gqyacdOcqP2iltfoEP2cCX
TLSH	T115D4237B47DF14BA72575FABBFFAA803BD881A4373C8B8B0308615EC6355449487096E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook rar

cocaman

Malicious email (T1566.001)
From: "Sondex South East Asia Pte Ltd <yulius.chandra@ptgbk.co.id>" (likely spoofed)
Received: "from growth-biz.live (growth-biz.live [185.81.128.82]) "
Date: "29 May 2023 14:23:14 +0200"
Subject: "AWB Details (AWB728590890733)"
Attachment: "AWB728590890733.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	AWB728590890733.exe
File size:	727'552 bytes
SHA256 hash:	44ca2fb5336865c635d0c1f4c75cfecec1b4fad8fe3de812c048c223cc06fba3
MD5 hash:	87b004d6cfed1e107af2c41fddfdbfaf
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

lolbin packed

Link:

https://www.filescan.io/uploads/647f28aa7c11a6632cb82efa/reports/a0389b65-52fa-4e19-b0b2-5686d6461f81/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd/

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2023-05-29 10:53:43 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 37 (54.05%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=harpxzsl2djdrxqu2noylwh5754givwiosaxqg3n6jg3zh2jxc6q._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:cs94 rat spyware stealer trojan

Link:

https://tria.ge/reports/230606-p9twasec4t/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Deletes itself

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3822fbe64bd0d238de14d35d85d8fdff786456c87481781b6df24dbc9f49b8bd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.