MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e
SHA3-384 hash: a7debbc2b0ca33cc3b8be4799fc87b0612747bf88675b4b5641e21195c8cf14883bac56b2cca34491cb459aa1f965eaf
SHA1 hash: 602c920625e801177638c6d388a5010e0b32f725
MD5 hash: 6db311c2d77b745601c87f47259e7d34
humanhash: fanta-four-lemon-winter
File name:Quote order#098799.zip
Download: download sample
Signature Formbook
Create hunting rule
File size:725'052 bytes
First seen:2022-04-04 14:39:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:qS2MlzZhvXySEU5sqWw9jcjh0JV0NZOWsssExhkqdb0gd7YS197NtJzN3xOSvjLY:qslDvCSZ39j7V0DKEXhdLUWtrxOKjLNy
TLSH T132F4335AB20DA69EC73CD063079AF8F518BD061E07286E4EC253E8EC935674B1A05DE6
Reporter cocaman
Tags:FormBook zip


Avatar
cocaman
Malicious email (T1566.001)
From: "bkmfilter.sales@gmail.com" (likely spoofed)
Received: "from [2.58.149.14] (unknown [2.58.149.14]) "
Date: "4 Apr 2022 15:24:19 +0200"
Subject: "Quote order#098799"
Attachment: "Quote order#098799.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.DLB.genEldorado.15397.21822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
File Type:
OOXML Office File
Link:
https://app.docguard.net/65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/624b0344aa7e43c6a6b70015/reports/9955092d-8a6e-4a5c-95c3-ad9942e47ee0/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e/
Threat name:
Win32.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2022-04-04 14:40:09 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
8 of 41 (19.51%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mx7pbassiqrz5y3i3slforssz2zriuv2jelkvtngram4kcvhg2pa._file
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook campaign:e0i2 rat spyware stealer trojan
Link:
https://tria.ge/reports/220404-r1vscafgg6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Formbook Payload
Formbook
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip 65fef0825244239ee368dc96574652ceb31452ba4916aacda68819c50aa7369e

(this sample)

Formbook

Executable exe e638074622767c226f5cdb70802da5b362d775d9eeffb5b69fc372a9b721225d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e638074622767c226f5cdb70802da5b362d775d9eeffb5b69fc372a9b721225d

Comments