MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4
SHA3-384 hash: 5aa8b33ca76a4db3231b449d51b7ee5836d6a0b0dcd45c9ceb60de386a4958aa59072639cf9bce71a34ba6a7ef556696
SHA1 hash: c8633a18ccb44aa2da1f6aa0091538ec38b6739e
MD5 hash: e885bf9d06a6d73acdf0686d86c9d24e
humanhash: connecticut-white-july-pluto
File name:isco order.r23
Download: download sample
Signature Formbook
Create hunting rule
File size:676'812 bytes
First seen:2022-09-16 14:30:21 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:MNghmfs95xT1KZc0XNOE2wH9Gwd33y2uIAyx1lwJB9uO63EzQJMeShA9S+u:sTf5c0XxlptAaTOZzQieOeu
TLSH T16CE4238CCFEA6B5348E995DE74029A7D7729CC49A73C4836C0BEDCF65E2935D4240DA0
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:FormBook r23 zip


Avatar
cocaman
Malicious email (T1566.001)
From: "John <info@unihomedesigns.com>" (likely spoofed)
Received: "from pldpukeb.koreapath.com (pldpukeb.koreapath.com [85.217.145.236]) "
Date: "Wed, 07 Sep 2022 00:14:01 -0700"
Subject: "NEW ISCE ORDER"
Attachment: "isco order.r23"

Intelligence

File Origin
# of uploads :
1
# of downloads :
813
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.42577.UNOFFICIAL
Create hunting rule

Win.Dropper.Nanocore-9967929-0
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/632488c435180ec88e2edf59/reports/3dc13548-1a1d-408b-9a9d-aba2c2f44cf9/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-09-07 07:15:44 UTC
File Type:
Binary (Archive)
Extracted files:
21
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lppcn7aywcygxvqsvoxcdpievvetkhlomxnerfo4ctkosnouagsa._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:o5df rat spyware stealer trojan
Link:
https://tria.ge/reports/220916-rvpzxabfhq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5bde26fc18b0b06bd612abae21bd04ad49351d6e65da4895dc14d4e935d401a4

(this sample)

Formbook

Executable exe 3164f706acbe68f271528451bc6a469956d490a839d00a1194438d9e3c187c37

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3164f706acbe68f271528451bc6a469956d490a839d00a1194438d9e3c187c37
  
Dropping
MD5 cac11d14a8b8c288538e976d0161c6f5

Comments