MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Formbook

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2
SHA3-384 hash:	1845d53094af1f41925afdacc8a26913f968faca51f349e335881250e7b35b808b0dec34d4cc0a672c68bfac1143465e
SHA1 hash:	c81acf11b8a9bd701594d692a44da8424417b5af
MD5 hash:	205d145695c9baaad734b9e51bf1ed07
humanhash:	missouri-cola-solar-nineteen
File name:	Invoice ETM0424-02-B.rar
Download:	download sample
Signature	Formbook Create hunting rule
File size:	598'734 bytes
First seen:	2024-11-27 02:36:44 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:yyRdHgIqAyWv76QbqCiYlsDKHgbH/gYR+TJwnn/FoX6ceqqJ9NO:vfAGxb8YcB7/nRI2/qwJrO
TLSH	T138D42335BE1ADB2DE8A04E3E3D53F2E0335654594A710950D048E8AA8CBA4D3FE55EFC
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook INVOICE rar

cocaman

Malicious email (T1566.001)
From: "sales@savicommaroc.com" (likely spoofed)
Received: "from [154.203.197.132] (unknown [154.203.197.132]) "
Date: "26 Nov 2024 18:36:30 -0800"
Subject: "RE: Invoice ETM0424-02-BF"
Attachment: "Invoice ETM0424-02-B.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

151

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Invoice -BF.exe
File size:	1'104'384 bytes
SHA256 hash:	d2c3ec17a82adc64cbf865b806ea8df48efcee31a55e5ee6e61de3dccbbcf6bf
MD5 hash:	a574d8e90f0174f5fe30edb676b9f106
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67468378d0583382434b65a1

Tags:

autoit emotet

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2/

Threat name:

Win32.Trojan.AutoitInject

Status:

Malicious

First seen:

2024-11-27 00:29:52 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p5xdhbv7guwy3hap6odivctrx4grkyuhrgkwwrb6notdbzfm6xra._file

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook campaign:cl21 discovery rat spyware stealer trojan

Link:

https://tria.ge/reports/241127-hx74tszlbm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Formbook payload

Formbook

Formbook family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7f6e3386bf352d8d9c0ff3868a8a71bf0d15628789956b443e6ba630e4acf5e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	AutoIT_Compiled Create hunting rule
Author:	@bartblaze
Description:	Identifies compiled AutoIT script (as EXE). This rule by itself does NOT necessarily mean the detected file is malicious.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)