MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d361c0f0a2be3573ceda5ba7f6357d8394562affb645058d2c71d6acf2d7cc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d361c0f0a2be3573ceda5ba7f6357d8394562affb645058d2c71d6acf2d7cc8
SHA3-384 hash: 89713822589941b9e23a9263bf705f65b5b45de166167e4c5c929293319bb33c91aabb413de916e22024b8bf287b57be
SHA1 hash: 18c5a25687371b5dd72b5958556991d24deccba2
MD5 hash: 55c2c05cd7b929c985f3ec3279db345e
humanhash: mississippi-high-chicken-don
File name:Quotation 400 KVA.lzh
Download: download sample
Signature Formbook
Create hunting rule
File size:420'548 bytes
First seen:2021-09-12 06:09:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:2xGH2yVjnfVe1TajHutAVsVNi1LQHDK2/+wN:SyV5ZjiNiEjT9
TLSH T18D9423A7AE404B09639B6C0735DBEC105DF1DEA8112266B88FCB58FE7D1928571FA04F
Reporter cocaman
Tags:FormBook lzh rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
355
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.30923.24924.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed snake
Link:
https://www.filescan.io/uploads/6174f76e9a5a1e91c5d1f633/reports/e606d4d3-6d60-4ecb-b760-1eebfe4ae592/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d361c0f0a2be3573ceda5ba7f6357d8394562affb645058d2c71d6acf2d7cc8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-12 06:10:15 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hu3bydykfprvophnuw5h6y2x3a4ukyvp7nsfawgsy4owvtznptea._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:ergs rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210912-gw38tafbak/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.barry-associates.com/ergs/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 3d361c0f0a2be3573ceda5ba7f6357d8394562affb645058d2c71d6acf2d7cc8

(this sample)

Formbook

Executable exe 85b8983f0d67758fd02b1aa875add6fd3fe6e88f9ade27cb535c490a0c367491

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 85b8983f0d67758fd02b1aa875add6fd3fe6e88f9ade27cb535c490a0c367491
  
Dropping
Formbook

Comments