MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bf60bc7f408e13988860051412a1c538537b0d532cf0283ae3eed2e36025043. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	3bf60bc7f408e13988860051412a1c538537b0d532cf0283ae3eed2e36025043
SHA3-384 hash:	2c05cb587a9849e24dade0604d8e7e6a0a14661c6e6ba171e8679ceb5cfe4f934456da6558122a5c02687baf9847444e
SHA1 hash:	bf152b051ec094908025e7cce4419444aef82121
MD5 hash:	dc8694245c13b1220685e0534c15a5e1
humanhash:	charlie-lithium-papa-lactose
File name:	Invoice 9673usd.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	705'272 bytes
First seen:	2024-11-27 01:45:17 UTC
Last seen:	2024-11-27 04:38:13 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:Gkp3PV4uHI6+oefOweP+LS2w9LQQUR/nv+vCUn9PFdsFecGAI50HPLJeJeYrdwj:GJuF+dfrVS2w9LxIXwttRcQcJ+0
TLSH	T13DE43349B102769F4539E411E1EA0FA7F6C56852BDCEDA49C023D92F1C968D2ADFCC0E
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook INVOICE rar

cocaman

Malicious email (T1566.001)
From: "Bahira A Samad <alasmacs@asmacs.com.np>" (likely spoofed)
Received: "from asmacs.com.np (unknown [45.137.22.240]) "
Date: "26 Nov 2024 20:37:03 -0800"
Subject: "RE: Request for SOA"
Attachment: "Invoice 9673usd.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Invoice 9673usd.exe
File size:	1'211'904 bytes
SHA256 hash:	3a8196dc93da2c2e2a9515cbc5ff7e47d679e04ce51957551ebabc6496cc3103
MD5 hash:	8fc0d31734978c221b06ed494b0388f4
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674679dbb31374f09834f74c

Tags:

autoit emotet

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3bf60bc7f408e13988860051412a1c538537b0d532cf0283ae3eed2e36025043

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3bf60bc7f408e13988860051412a1c538537b0d532cf0283ae3eed2e36025043/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-27 01:45:21 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hp3axr7ubdqttcegabiuckq4koctpmgvglhqfa5oh3ws4nqckbbq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/241127-hx74tszlbl/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3bf60bc7f408e13988860051412a1c538537b0d532cf0283ae3eed2e36025043

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)