MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024
SHA3-384 hash: 273daf47b52fafd6d2e2605b2cdc333fec60ea5a646447f4e1a5542de515f7f6bad19a0945d8cce6a91da84cededc182
SHA1 hash: 74fc2b152c43eabe965123e2108bba870945414b
MD5 hash: bdd41225c3653605911c1d1fd197f922
humanhash: nebraska-wolfram-ack-carolina
File name:SwiftO#PNH310059_pdf.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:684'604 bytes
First seen:2024-07-15 07:40:58 UTC
Last seen:2024-07-15 07:41:33 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:BhgNoAiEantM0zgXvZ7cDyHHwCWbJ+Ye+oAmipUQZxocwN7zhfmAPWgpxJ3iBC9Q:BmNYhLwZIDynUJn04UQscwFdfZp/iBYQ
TLSH T13FE433A5E7B125B76729EC24CBDB1B04AD4964D0F9ECFFF508884F1A100C41BAA7534B
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook INVOICE payment rar SWIFT


Avatar
cocaman
Malicious email (T1566.001)
From: "accounts<andi_lai@chinabestgmts.com.tw>" (likely spoofed)
Received: "from hosted-by.rootlayer.net (unknown [45.137.22.85]) "
Date: "12 Jul 2024 17:08:38 +0200"
Subject: "RE: INVOICE OPNH310059 Payment Receipt"
Attachment: "SwiftO#PNH310059_pdf.rar"

Intelligence

File Origin
# of uploads :
2
# of downloads :
169
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:afn6Od8oV1sUzD6.exe
File size:736'768 bytes
SHA256 hash: 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33
MD5 hash: a7d3bd55656bdc04c270315d083b59c1
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20240712-1835.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6694d29984e955866872b31bwin10vpnfull_triage
Tags:
Generic Network Static Swotter
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
exploit packed
Link:
https://www.filescan.io/uploads/6694d2a6ed3116b7b3d3f8d1/reports/391f2ea2-916d-498f-9145-f83add284201/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024/
Threat name:
ByteCode-MSIL.Trojan.SuspMsilIn7zEmail
Create hunting rule
Status:
Malicious
First seen:
2024-07-12 16:29:21 UTC
File Type:
Binary (Archive)
Extracted files:
15
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oybi3pzppqfyse2exybssrgtvviedcvfgvgplmv6yjiclw6xaasa._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/240715-klfasaxfkq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DYEPACK
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AgentTesla_DIFF_Common_Strings_01
Create hunting rule
Author:schmidtsz
Description:Identify partial Agent Tesla strings
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 76028dbf2f7c0b891344be032944d3ad50418aa5354cf5b2bec25025dbd70024

(this sample)

Formbook

Executable exe 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5297372fe85eea3ecc0d271b5567f2c7ee75bd3a04e745debddb04c9b05dae33
  
Dropping
Formbook
  
Dropping
MD5 a7d3bd55656bdc04c270315d083b59c1

Comments