MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51
SHA3-384 hash:	864d8c2d4e37a281337845aeed4adb3fb790e6bfa8253d8ef9a1a0dc1361c1497f267b15555d2a165e98fc00e6b7f111
SHA1 hash:	b5dfd43df1613415343434ff399d216fcaa142e5
MD5 hash:	f575ed3a30393592f2f2a4dcd0d7dafa
humanhash:	fanta-foxtrot-tango-minnesota
File name:	Invoice no.9673.rar
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	721'217 bytes
First seen:	2024-11-28 08:05:25 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:St7+pTIKbvLNCZJ0Ic6NHD++01i4tUK0i7A6kQa3QfWKZynnEhz170U9abHmk:St8LNu0Ic6Natp0GkQ0QZZynnIxQnGk
TLSH	T18DE4336EA9137C03C5A97033D3068C3656A7686B243F6561E4560AFC738EB2175BCEE8
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook INVOICE rar

cocaman

Malicious email (T1566.001)
From: "Bahira A Samad <info@asmacsbh.com>" (likely spoofed)
Received: "from asmacsbh.com (unknown [45.137.22.240]) "
Date: "27 Nov 2024 18:41:38 -0800"
Subject: "RE: Request for SOA"
Attachment: "Invoice no.9673.rar"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

98

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Invoice no.9673.exe
File size:	1'227'776 bytes
SHA256 hash:	5c91fdcc94d5c660d185a1a8ea3df8d362158357d4ce3c439ea025bd78e8b23f
MD5 hash:	fbc4bfc223d278ad0b8f1f4e087a570a
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674825aad0583382434ba4cc

Tags:

autoit emotet

FileScan.io

Gathering data

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/772c2e186f85d316aab180b3f3b8ecc1eb69e2c4181df58d9e639a14da7e0d51/

ReversingLabs TitaniumCloud Win32.Trojan.AutoitInject

Threat name:

Win32.Trojan.AutoitInject

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-28 01:10:51 UTC

File Type:

Binary (Archive)

Extracted files:

28

AV detection:

19 of 24 (79.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o4wc4gdpqxjrnkvrqcz7hohmyhvwtywedao7ldm6monbjwt6bviq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

discovery

Link:

https://tria.ge/reports/241128-lfbk3sypgk/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.