MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b00551171394128e6391e1461ea221fbccdaca7413a4bb1ebc3c5ec2d3ddc22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b00551171394128e6391e1461ea221fbccdaca7413a4bb1ebc3c5ec2d3ddc22
SHA3-384 hash: 1d58683654eb0a4d5f1bd57d4ed6d9e4291e9fa3dc6eae7d1055864073ae3077ffdc5d07cef962e333a28b6b7896f3a8
SHA1 hash: a48c313bb92ed0d3b57771ec2d42aa02a3cfc35a
MD5 hash: dcc8cb63a42201eec4a1d727dd8eeab5
humanhash: cup-india-xray-violet
File name:Safari and our details.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:602'043 bytes
First seen:2022-09-16 09:01:27 UTC
Last seen:2022-09-16 09:12:16 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:VbYaGWb2z76Pau70a0No4fhl71LTz99JPxT2lnvmNkYixffF4Unv4:WaZ6zmPa60NJxTJ5Ufxlnv4
TLSH T1C4D42373ADBA5169709C71880FADE2089DE1D9A7525B2FC02EA00A3E499ED1095734EF
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: "Ms Anna Cheng <nonereply@wetransfer.com>" (likely spoofed)
Received: "from wetransfer.com (unknown [141.98.10.25]) "
Date: "06 Sep 2022 12:52:14 +0200"
Subject: "Inquiry bookings & Safari"
Attachment: "Safari and our details.rar"

Intelligence

File Origin
# of uploads :
4
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b00551171394128e6391e1461ea221fbccdaca7413a4bb1ebc3c5ec2d3ddc22/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-09-06 10:24:44 UTC
File Type:
Binary (Archive)
Extracted files:
28
AV detection:
20 of 40 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jmafkelrhfasrzrzdykgd2rcd66m3lfhie5exmplypc6ylj53qra._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:rsea rat spyware stealer trojan
Link:
https://tria.ge/reports/220916-kzf48sahck/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/4b00551171394128e6391e1461ea221fbccdaca7413a4bb1ebc3c5ec2d3ddc22

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 4b00551171394128e6391e1461ea221fbccdaca7413a4bb1ebc3c5ec2d3ddc22

(this sample)

Formbook

Executable exe 36674027d875510c1e5b987c838e8d7b17d4ec489ef27dbf3b514ade9c499203

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 36674027d875510c1e5b987c838e8d7b17d4ec489ef27dbf3b514ade9c499203
  
Dropping
Formbook
  
Dropping
MD5 74bfe3cbab7f8c3b92134ca012caffd5

Comments