MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bd626d2c9a7eee5abe70b881a01da79e8eaf3c88a9b780384092cfa58691be7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	3bd626d2c9a7eee5abe70b881a01da79e8eaf3c88a9b780384092cfa58691be7
SHA3-384 hash:	51dc03ef7b7c0feeb7197ea72d2f5350f4d51600e46274df92cd66d0be56e7d8bd232bb0d57cb296d93d9e929904d5f6
SHA1 hash:	d4a3240484b3349f93d8e0882b947d938d98875c
MD5 hash:	b9a1028964f08b6acae9da27d1a61432
humanhash:	london-lemon-georgia-music
File name:	IN2K131085T_(2 NOV 22).rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	675'141 bytes
First seen:	2022-11-04 07:45:19 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:6sI9u1zNPcUyGuBJYQ933I6FXo8AvBjPxBKiPmDbdDkPMmmn8qCRoahv9:6sI9uhWRzJYU3LRobPaiPm32EmG6F
TLSH	T1B0E423F4182D9A4DF0FA72E2C7EF6B21693D8462852FC8C67BDCE1E0013DB50A899755
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	FormBook QUOTATION rar

cocaman

Malicious email (T1566.001)
From: "Nurul Syahirah <kyn.mat@fdandersonagency.com>" (likely spoofed)
Received: "from antyfugo.fdandersonagency.com (antyfugo.fdandersonagency.com [92.52.217.135]) "
Date: "03 Nov 2022 21:43:00 -0700"
Subject: "Quotation; INV # :SO-US-1-2022-11-0003"
Attachment: "IN2K131085T_(2 NOV 22).rar"

Intelligence

File Origin

# of uploads :

# of downloads :

191

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	3Z3IIgoQ1CFcFuW.exe
File size:	924'672 bytes
SHA256 hash:	a3f2c927bfca234ef5f9b7bc01f6bcba0c5aeb85e6e8d5d5b6907d4e338f0314
MD5 hash:	0d2bac69efb585ccf77a1cfd1056f03a
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6364c33d15611f8d8bf8c4a6/reports/6f5e8dbc-111c-4cad-afb6-2c1b907d42c5/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3bd626d2c9a7eee5abe70b881a01da79e8eaf3c88a9b780384092cfa58691be7/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-11-03 12:22:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 40 (47.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hplcnuwju7xolk7hboebuao2phuov46irknxqa4ebewpuwdjdptq._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:axe3 rat spyware stealer trojan

Link:

https://tria.ge/reports/221104-jlztradbg8/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.65

Link:

https://yomi.yoroi.company/submissions/3bd626d2c9a7eee5abe70b881a01da79e8eaf3c88a9b780384092cfa58691be7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.