MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e
SHA3-384 hash: 1756675dc0249567f352197625e4a8890dcdd592bd6c6c13ffbfd3635a567235ca27aefbedbfc8c3246eed0b4e859644
SHA1 hash: 8289dbfae66ef48e6a52eb4cb6ccf24001b2a9ec
MD5 hash: baf79ef144fd6110f2912e5a31947c44
humanhash: magazine-magazine-papa-golf
File name:Documents.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:709'000 bytes
First seen:2023-06-08 08:50:04 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:67xvo0uUwJNdFPu2jayUhdIoh0BJqXjDepLlM4/y2iSPtk36ET8I58UA:67xwnzBuJyHoyqXL4/VTPtW8IGP
TLSH T147E423472EE680933C05EC2B4FF68593516994C3C194B493E64EB9F624EAB3DC06DAC7
TrID 58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1)
41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter cocaman
Tags:FormBook rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Sudha J.F"<athompson@enzo.com>" (likely spoofed)
Received: "from enzo.com (unknown [185.222.57.71]) "
Date: "5 Jun 2023 16:36:09 +0200"
Subject: "RE: Revised BL"
Attachment: "Documents.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
CH CH
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Thunderbird.lnk
File size:986 bytes
SHA256 hash: ac9a43007d538c9103b578a18ed431c96669bf6359b820fed6a7bd4410604631
MD5 hash: 7adb7f935d2a0d4965acf2823b46f92b
MIME type:application/octet-stream
Signature Formbook
File name:Documents.exe
File size:844'800 bytes
SHA256 hash: eed6daf044779a9e7258ef8e0a4d35b5d174fe4c38678efd4d28d1d15a500541
MD5 hash: 29e08138c62f63dd42f6b1d84c4c56a3
MIME type:application/x-dosexec
Signature Formbook
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
comodo formbook packed remcos
Link:
https://www.filescan.io/uploads/64819676b941c5c62d6228a2/reports/1e6bcb19-a7b3-4ce7-a079-d861c89c3df8/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-06-05 17:08:22 UTC
File Type:
Binary (Archive)
Extracted files:
26
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o3tqx27ilgmcphowuakhgs7nkvxkr4adtt22sxtoaub5hbf5lgha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230608-ktbbssdh51/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 76e70bebe85998279dd6a014734bed556ea8f0039cf5a95e6e0503d384bd598e

(this sample)

Formbook

Executable exe eed6daf044779a9e7258ef8e0a4d35b5d174fe4c38678efd4d28d1d15a500541

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eed6daf044779a9e7258ef8e0a4d35b5d174fe4c38678efd4d28d1d15a500541
  
Dropping
SHA256 ac9a43007d538c9103b578a18ed431c96669bf6359b820fed6a7bd4410604631
  
Dropping
MD5 29e08138c62f63dd42f6b1d84c4c56a3
  
Dropping
MD5 7adb7f935d2a0d4965acf2823b46f92b

Comments