MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7efa60e285e197bda5dfaea446f3288d9227725fe5e6f4f36731628585c23ff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 6

Intelligence 6 IOCs YARA 7 File information Comments

SHA256 hash:	7efa60e285e197bda5dfaea446f3288d9227725fe5e6f4f36731628585c23ff4
SHA3-384 hash:	78b04f9f4ccfce74cdf8b65980a947c8c00c651dcb04882b957e9dcfc323329b85e4516f8d8f0f3d6b51fbb156adb1fa
SHA1 hash:	73c8f96c9fa8bab1e7963b67d7a53ec955a7d7bb
MD5 hash:	9eb4bd17e23823312ab73872b4eb3e97
humanhash:	fix-hydrogen-nineteen-eleven
File name:	3500887776pdf.r15
Download:	download sample
Signature	Formbook Create hunting rule
File size:	612'131 bytes
First seen:	2024-11-29 01:30:30 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:GHxdeJMMR8AoZDyX7hjfzm5TiYo9VfC8v6uXWtzmAurlt7imO5Xewwr3:GfeJMhhFu9WGYo+XuGtzmrrji2D3
TLSH	T1F9D423E32B1DF72B3406751F3715F8DA2C92828DFA44492C748AB3B9612219F8996D2D
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook r15 rar RFQ

cocaman

Malicious email (T1566.001)
From: "jm.caucheteux@degroofpetercam.com" (likely spoofed)
Received: "from [154.203.197.132] (unknown [154.203.197.132]) "
Date: "28 Nov 2024 17:30:01 -0800"
Subject: "RE: RFQ 3500887776"
Attachment: "3500887776pdf.r15"

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	eeertttttttt.exe
File size:	1'119'744 bytes
SHA256 hash:	445c05ab18917bcc80fe2e712ead44f6452ed03a4d06d0200d6e3cbf434997c3
MD5 hash:	09297b4f56dc12e62c275f5f6b1be047
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67491a54e64d1c722d79e671

Tags:

autoit emotet

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7efa60e285e197bda5dfaea446f3288d9227725fe5e6f4f36731628585c23ff4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7efa60e285e197bda5dfaea446f3288d9227725fe5e6f4f36731628585c23ff4/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-28 23:59:35 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p35gbyuf4gl33jo7v2sen4zirwjco4s74xtpj43hgfrilboch72a._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:cl21 discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/241129-hrg1fs1qdt/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7efa60e285e197bda5dfaea446f3288d9227725fe5e6f4f36731628585c23ff4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)