MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c
SHA3-384 hash:	3cba3aab310a109abe33bd8bbb20bee1575fc35f6fcaa44784488023285371f0f25da430a4d743fe12a3168a3df01b1b
SHA1 hash:	ef33190ccf0d1164d0b14797c5f70278a2a1e729
MD5 hash:	9483cac9c0c454f506af422bcfe433f7
humanhash:	cardinal-six-avocado-zebra
File name:	Trf_USD 2490.00.zip
Download:	download sample
Signature	Formbook Create hunting rule
File size:	265'244 bytes
First seen:	2023-08-17 09:30:41 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:8gmYsfoa8is96wAH0myiUlzeXqCukNHe1b:qua8L9tziEmSb
TLSH	T10E441272A13F312B5B7A9637B0512EA30788006FBC2E94CB545A385C0BDDDFDD908D6A
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	cocaman
Tags:	FormBook Shipping zip

cocaman

Malicious email (T1566.001)
From: "Jackal He <jackal.he@corten-shipping.com>" (likely spoofed)
Received: "from [37.139.129.109] (unknown [37.139.129.109]) "
Date: "17 Aug 2023 02:36:36 +0200"
Subject: "=?UTF-8?B?5Zue5aSNOiBDT1JURU4tU09BLVVTRDI0OTAuMDA=?="
Attachment: "Trf_USD 2490.00.zip"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Trf_USD 2490.00.exe
File size:	279'257 bytes
SHA256 hash:	57b5c0581d2170ca86ffe5ec13269dc3b7813d46476d82ade07c7f49bd95eae6
MD5 hash:	f6ce3953c56c3c950f4dec97a40f4991
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Rogue.0hr.20230817-0239.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c/results/dashboard

Gathering data

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c/

Threat name:

Win32.Trojan.InjectorX

Status:

Malicious

First seen:

2023-08-16 23:12:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mf5mfr4u7muxrfakitqkkkhurnle2exwlj6kw7ihnmbm37a5gcga._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:sn26 rat spyware stealer trojan

Link:

https://tria.ge/reports/230817-nvmb8shb26/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Deletes itself

Loads dropped DLL

Formbook payload

Formbook

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/617ac2c794fb2978940a44e0a528f48b564d12f65a7cab7d076b02cdfc1d308c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.