MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 770f4428f2f3a5116387a7be62d26b64c214dfad7e670a9f06cdae28cb4909f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 4

Intelligence 4 IOCs YARA 11 File information Comments

SHA256 hash:	770f4428f2f3a5116387a7be62d26b64c214dfad7e670a9f06cdae28cb4909f7
SHA3-384 hash:	69448044565d21041c5f4a694474640ffd7e222502b6a9dc8fec832d0b3eb629586aec158dcece19fb8b0ddb42756197
SHA1 hash:	81d18daa946fe4b8d75a7ccc9b3f562e8c56b6ab
MD5 hash:	2d10f5b89dca48dda87e6af1a0071649
humanhash:	october-fanta-cola-delaware
File name:	ón-1634.pdf.bz
Download:	download sample
Signature	Formbook Create hunting rule
File size:	681'290 bytes
First seen:	2024-04-22 16:47:13 UTC
Last seen:	2024-04-23 06:38:07 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:yFlpMo8kJbqkM2HEsBn3yfF86VpEYiMYIt1Uykamz5VdP96rKVSKAU93hsmELv:EwcbqkM2XnCfFJpoMYIdnm9VdQrJUcLv
TLSH	T143E43381D76C39EC8EF55D1AF808973B80D441593298DE2A7A8C3447CA9F92B6F704BD
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	bz FormBook rar

cocaman

Malicious email (T1566.001)
From: "ventas.autoservicio@bioom.mx" (likely spoofed)
Received: "from [45.62.170.184] (unknown [45.62.170.184]) "
Date: "22 Apr 2024 09:46:14 -0700"
Subject: "Cotizaci=?UTF-8?B?w7Nu?="
Attachment: "ón-1634.pdf.bz"

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	m2 Cotización-1634.pdf.exe
File size:	757'760 bytes
SHA256 hash:	c039e290e4a70ee9df0d6ebcca435676c758a2a6a0bf734cc37fce88a03d4bde
MD5 hash:	6e5ca1f37b8648039bfafdd8cb1e822f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/770f4428f2f3a5116387a7be62d26b64c214dfad7e670a9f06cdae28cb4909f7/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2024-04-22 16:47:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 38 (44.74%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o4huikhs6osrcy4hu67gfutlmtbbjx5npztqvhygzwxcrs2jbh3q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/240422-wnk5laec9t/

Behaviour

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research

Rule name:	SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4 Create hunting rule
Author:	Florian Roth
Description:	Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:	Internal Research