MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c
SHA3-384 hash: 1977ae357ed1a8d0fd02f2dd0f3cd5ccd57fa585f9999e7e366f46d54e2cec10ca2539e80e39edbffcd4b31d9cc80487
SHA1 hash: 290f1d361bb2c50ed363f71fb78e044260cdb6a5
MD5 hash: cc001a6032c0a21110f648902588c7ec
humanhash: potato-coffee-salami-sad
File name:swift_payment_pdf.gz
Download: download sample
Signature Formbook
Create hunting rule
File size:692'403 bytes
First seen:2024-07-05 06:30:25 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:p0TaTNV/ZYgio+DKRypK9k7nAQChhWvOCqDtZdSriLlpuemv/SXWkr:pcw0gyKRL9x3+qDXdfLQMr
TLSH T12CE423B8D6FD9DB11E6A12C28811D7CA3EE1547CF30BA27503B37A3D8182DC5E611E68
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook gz payment SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: ""UAE Exchange Centre L.L.C" <info@jimcosl.net>" (likely spoofed)
Received: "from jimcosl.net (jimcosl.net [107.173.160.187]) "
Date: "3 Jul 2024 20:38:21 -0400"
Subject: "***Attached Payment Details***"
Attachment: "swift_payment_pdf.gz"

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:swift_payment_pdf.exe
File size:730'624 bytes
SHA256 hash: e7c888a111eeb26eec94afc97e0f9b838fda41ab74e083cb5b94f06800890d2d
MD5 hash: 8e32f87b4f51fac392122d3c43b2e54f
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6686799a94b35ad6fbebcc24win10vpnfull_triage
Tags:
m s i l
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed
Link:
https://www.filescan.io/uploads/6687932a49a1c8306269cb56/reports/557b3fee-01b9-41de-9ae9-e098bd7aee5a/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c/
Threat name:
ByteCode-MSIL.Trojan.ZmutzyPong
Create hunting rule
Status:
Malicious
First seen:
2024-07-04 17:25:19 UTC
File Type:
Binary (Archive)
Extracted files:
6
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nespia5dq65jnuiyv3vjs2pmw3rsmv3wu6acsvj52sw33e76kz6a._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240705-h9h1gavarj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DYEPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

gz 6924f403a387ba96d118aeea9969ecb6e3265776a78029553dd4adbd93fe567c

(this sample)

Formbook

Executable exe e7c888a111eeb26eec94afc97e0f9b838fda41ab74e083cb5b94f06800890d2d

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e7c888a111eeb26eec94afc97e0f9b838fda41ab74e083cb5b94f06800890d2d
  
Dropping
Formbook

Comments