MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3
SHA3-384 hash: 5a54601b152cd2d0e82c936fab8867ae3e5e683e65107876e43ba27d385b9cabfdceba7dcb8466d9dbef3089e0517774
SHA1 hash: 367f1be22ba48b9cb65807d36b99775c98208856
MD5 hash: ae1516fa6f38b6c1a3e865041b869260
humanhash: spaghetti-harry-muppet-arkansas
File name:Scan.Salary.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:828'984 bytes
First seen:2021-08-09 11:09:17 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:1SxKI7hmtiQw+sF33xRJBbmbkcSIPJtUxeLj8U7:1SNtmtiBN3plwBPJqijN
TLSH T1070523FFD9C7AC52FA3C022D39F20EA099134724519EE8F6C4B94260E07467A89DDBC4
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "HRMANAGER johnlay.ch <hr.hr@mcgill.ca>" (likely spoofed)
Received: "from server.regencytours.in (ded5726.inmotionhosting.com [209.182.215.10]) "
Date: "9 Aug 2021 08:48:17 +0000"
Subject: "YOUR EMPLOYMENT STATUS"
Attachment: "Scan.Salary.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WZA.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3/
Threat name:
ByteCode-MSIL.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-08-09 09:11:24 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l4x7vsmplfxsvsirvwbf7llsfxmlge7m5cue2dglwpiwdd5mghjq._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:bkbk rat spyware stealer suricata trojan
Link:
https://tria.ge/reports/210809-jp5qveah46/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
Malware Config
C2 Extraction:
http://www.aozhengaodi.com/bkbk/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 5f2ffac98f596f2ac911ad825fad722dd8b313ece8a84d0ccbb3d1618fac31d3

(this sample)

Formbook

Executable exe 9a51a3cc373a659071b939aabb27ed28c324e0e5ee7eb68967de657158e3c09f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a51a3cc373a659071b939aabb27ed28c324e0e5ee7eb68967de657158e3c09f
  
Dropping
Formbook

Comments